bump version to 0.7.0

downgarde incomplete sib heuristic to informational
suggest using different usb to troubleshoot
2026-05-31 10:13:35 -07:00 · 2025-09-24 11:17:39 -07:00 · 2025-09-24 11:07:48 -07:00 · 2025-09-24 10:52:13 -07:00 · 2025-09-23 10:05:05 -07:00 · 2025-09-23 10:05:05 -07:00
74 changed files with 1268 additions and 364 deletions
@@ -1,3 +1,11 @@
+[alias]
+# Build the daemon with "firmware" profile and "ring" TLS backend.
+# Requires a cross-compiler (see github actions workflows) and is very slow to build.
+build-daemon-firmware = "build -p rayhunter-daemon --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile firmware --no-default-features --features ring-tls"
+# Build the daemon with "firmware-devel" profile and "rustcrypto" backend.
+# Works with just the Rust toolchain, and is medium-slow to build. Binaries are slightly larger.
+build-daemon-firmware-devel = "build -p rayhunter-daemon --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile firmware-devel"
+
 [target.aarch64-apple-darwin]
 linker = "rust-lld"
 rustflags = ["-C", "target-feature=+crt-static"]
@@ -217,7 +217,7 @@ jobs:
          targets: armv7-unknown-linux-musleabihf
      - uses: Swatinem/rust-cache@v2
      - name: Build rootshell (armv7)
-        run: cargo build --bin rootshell --target armv7-unknown-linux-musleabihf --profile=firmware
+        run: cargo build -p rootshell --bin rootshell --target armv7-unknown-linux-musleabihf --profile=firmware
      - uses: actions/upload-artifact@v4
        with:
          name: rootshell
@@ -225,7 +225,10 @@ jobs:
          if-no-files-found: error

  build_rayhunter:
-    if: needs.files_changed.outputs.daemon_changed != '0'
+    # build_rust_installer needs this step. so when installer_changed, we need
+    # to build this step too. if we skip this step because only the installer
+    # changed, the build_rust_installer step will be skipped too.
+    if: needs.files_changed.outputs.daemon_changed != '0' || needs.files_changed.outputs.installer_changed != '0'
    needs:
      - check_and_test
      - files_changed
@@ -239,6 +242,8 @@ jobs:
        with:
          targets: armv7-unknown-linux-musleabihf
      - uses: Swatinem/rust-cache@v2
+      - name: Install ARM cross-compilation toolchain
+        run: sudo apt-get update && sudo apt-get install -y gcc-arm-linux-gnueabihf
      - name: Build rayhunter-daemon (armv7)
        run: |
          pushd daemon/web
@@ -253,7 +258,7 @@ jobs:
          # what the feature selection in rayhunter-daemon is.
          #
          # https://github.com/rust-lang/cargo/issues/4463
-          cargo build -p rayhunter-daemon --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile=firmware
+          CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc cargo build-daemon-firmware
      - uses: actions/upload-artifact@v4
        with:
          name: rayhunter-daemon
@@ -344,7 +349,7 @@ jobs:
          else
            mv installer-$platform/installer "$dest"/installer
          fi
-          cp -r rayhunter-daemon rootshell/rootshell dist/* installer/install.ps1 "$dest"/
+          cp -r rayhunter-check-* rayhunter-daemon rootshell/rootshell dist/* installer/install.ps1 "$dest"/
          zip -r "$dest.zip" "$dest"
          sha256sum "$dest.zip" > "$dest.zip.sha256"

@@ -962,9 +962,9 @@ dependencies = [

 [[package]]
 name = "ed25519-dalek"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
 "curve25519-dalek",
 "ed25519",
@@ -1267,8 +1267,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -1278,9 +1280,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "r-efi",
 "wasi 0.14.2+wasi-0.2.4",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -1729,7 +1733,7 @@ dependencies = [

 [[package]]
 name = "installer"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
 "adb_client",
 "aes",
@@ -1964,6 +1968,12 @@ dependencies = [
 "imgref",
 ]

+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "mach2"
 version = "0.4.2"
@@ -2575,6 +2585,61 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"

+[[package]]
+name = "quinn"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.12",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.3",
+ "lru-slab",
+ "rand 0.9.1",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.12",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcebb1209ee276352ef14ff8732e24cc2b02bbac986cd74a4c81bcb2f9881970"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.40"
@@ -2707,7 +2772,7 @@ dependencies = [

 [[package]]
 name = "rayhunter"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
 "bytes",
 "chrono",
@@ -2729,7 +2794,7 @@ dependencies = [

 [[package]]
 name = "rayhunter-check"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
 "clap",
 "futures",
@@ -2743,7 +2808,7 @@ dependencies = [

 [[package]]
 name = "rayhunter-daemon"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -2838,6 +2903,7 @@ dependencies = [
 "log",
 "percent-encoding",
 "pin-project-lite",
+ "quinn",
 "rustls",
 "rustls-pki-types",
 "serde",
@@ -2888,7 +2954,7 @@ dependencies = [

 [[package]]
 name = "rootshell"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
 "nix",
 ]
@@ -2930,6 +2996,12 @@ version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"

+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -2972,6 +3044,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7160e3e10bf4535308537f3c4e1641468cd0e485175d6163087c0393c7d46643"
 dependencies = [
 "once_cell",
+ "ring",
 "rustls-pki-types",
 "rustls-webpki 0.103.3",
 "subtle",
@@ -2984,6 +3057,7 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
 dependencies = [
+ "web-time",
 "zeroize",
 ]

@@ -3082,9 +3156,9 @@ dependencies = [

 [[package]]
 name = "semver"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"

 [[package]]
 name = "serde"
@@ -3365,7 +3439,7 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"

 [[package]]
 name = "telcom-parser"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
 "asn1-codecs",
 "asn1-compiler",
@@ -3492,6 +3566,21 @@ dependencies = [
 "zerovec",
 ]

+[[package]]
+name = "tinyvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
 [[package]]
 name = "tokio"
 version = "1.45.0"
@@ -3889,6 +3978,16 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "1.0.0"
@@ -1,7 +1,19 @@
-![Rayhunter Logo - An Orca taking a bite out of a cellular signal bar](https://www.eff.org/files/styles/media_browser_preview/public/banner_library/rayhunter-banner.png)
-
 # Rayhunter
-
 ![Tests](https://github.com/EFForg/rayhunter/actions/workflows/main.yml/badge.svg)

-Rayhunter is an IMSI Catcher Catcher for the Orbic mobile hotspot. To learn more, check out the [Rayhunter Book](https://efforg.github.io/rayhunter/).
+![Rayhunter Logo - An Orca taking a bite out of a cellular signal bar](https://www.eff.org/files/styles/media_browser_preview/public/banner_library/rayhunter-banner.png)
+
+Rayhunter is a project for detecting IMSI catchers, also known as cell-site simulators or stingrays. It was first designed to run on a cheap mobile hotspot called the Orbic RC400L, but thanks to community efforts can [support some other devices as well](https://efforg.github.io/rayhunter/supported-devices.html).
+It's also designed to be as easy to install and use as possible, regardless of your level of technical skills, and to minimize false positives. 
+
+&rarr;  Check out the [installation guide](https://efforg.github.io/rayhunter/installation.html) to get started.
+
+&rarr; To learn more about the aim of the project, and about IMSI catchers in general, please check out our [introductory blog post](https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying). 
+
+&rarr; For discussion, help, or to join the mattermost channel and get involved with the project and community check out the [many ways listed here](https://efforg.github.io/rayhunter/support-feedback-community.html)!
+
+&rarr; To learn more about the project in general check out the [Rayhunter Book](https://efforg.github.io/rayhunter/).
+
+**LEGAL DISCLAIMER:** Use this program at your own risk. We believe running this program does not currently violate any laws or regulations in the United States. However, we are not responsible for civil or criminal liability resulting from the use of this software. If you are located outside of the US please consult with an attorney in your country to help you assess the legal risks of running this program.
+
+*Good Hunting!*
@@ -1,6 +1,6 @@
 [package]
 name = "rayhunter-check"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2024"

 [dependencies]
@@ -1,9 +1,14 @@
 [package]
 name = "rayhunter-daemon"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2024"
 rust-version = "1.88.0"

+[features]
+default = ["rustcrypto-tls"]
+rustcrypto-tls = ["reqwest/rustls-tls-webpki-roots-no-provider", "dep:rustls-rustcrypto"]
+ring-tls = ["reqwest/rustls-tls-webpki-roots"]
+
 [dependencies]
 rayhunter = { path = "../lib" }
 toml = "0.8.8"
@@ -25,8 +30,6 @@ image = { version =  "0.25.1", default-features = false, features = ["png", "gif
 tempfile = "3.10.1"
 async_zip = { version = "0.0.17", features = ["tokio"] }
 anyhow = "1.0.98"
-reqwest = { version = "0.12.20", default-features = false, features = [
-    "rustls-tls-webpki-roots-no-provider",
-] }
-rustls-rustcrypto = "0.0.2-alpha"
+reqwest = { version = "0.12.20", default-features = false }
+rustls-rustcrypto = { version = "0.0.2-alpha", optional = true }
 async-trait = "0.1.88"
@@ -0,0 +1,111 @@
+use std::{path::Path, time::Duration};
+
+use log::{error, info};
+use rayhunter::Device;
+use serde::Serialize;
+use tokio::select;
+use tokio_util::{sync::CancellationToken, task::TaskTracker};
+
+use crate::{
+    error::RayhunterError,
+    notifications::{Notification, NotificationType},
+};
+
+pub mod orbic;
+pub mod tmobile;
+pub mod wingtech;
+
+const LOW_BATTERY_LEVEL: u8 = 10;
+
+#[derive(Clone, Copy, PartialEq, Debug, Serialize)]
+pub struct BatteryState {
+    level: u8,
+    is_plugged_in: bool,
+}
+
+async fn is_plugged_in_from_file(path: &Path) -> Result<bool, RayhunterError> {
+    match tokio::fs::read_to_string(path)
+        .await
+        .map_err(RayhunterError::TokioError)?
+        .chars()
+        .next()
+    {
+        Some('0') => Ok(false),
+        Some('1') => Ok(true),
+        _ => Err(RayhunterError::BatteryPluggedInStatusParseError),
+    }
+}
+
+async fn get_level_from_percentage_file(path: &Path) -> Result<u8, RayhunterError> {
+    tokio::fs::read_to_string(path)
+        .await
+        .map_err(RayhunterError::TokioError)?
+        .trim_end()
+        .parse()
+        .or(Err(RayhunterError::BatteryLevelParseError))
+}
+
+pub async fn get_battery_status(device: &Device) -> Result<BatteryState, RayhunterError> {
+    Ok(match device {
+        Device::Orbic => orbic::get_battery_state().await?,
+        Device::Wingtech => wingtech::get_battery_state().await?,
+        Device::Tmobile => tmobile::get_battery_state().await?,
+        _ => return Err(RayhunterError::FunctionNotSupportedForDeviceError),
+    })
+}
+
+pub fn run_battery_notification_worker(
+    task_tracker: &TaskTracker,
+    device: Device,
+    notification_channel: tokio::sync::mpsc::Sender<Notification>,
+    shutdown_token: CancellationToken,
+) {
+    task_tracker.spawn(async move {
+        // Don't send a notification initially if the device starts at a low battery level.
+        let mut triggered = match get_battery_status(&device).await {
+            Err(RayhunterError::FunctionNotSupportedForDeviceError) => {
+                info!("Battery level function not supported for device");
+                false
+            }
+            Err(e) => {
+                error!("Failed to get battery status: {e}");
+                true
+            }
+            Ok(status) => status.level <= LOW_BATTERY_LEVEL,
+        };
+
+        loop {
+            select! {
+                _ = shutdown_token.cancelled() => break,
+                _ = tokio::time::sleep(Duration::from_secs(15)) => {}
+            }
+
+            let status = match get_battery_status(&device).await {
+                Err(e) => {
+                    error!("Failed to get battery status: {e}");
+                    continue;
+                }
+                Ok(status) => status,
+            };
+
+            // To avoid flapping, if the notification has already been triggered
+            // wait until the device has been plugged in and the battery level
+            // is high enough to re-enable notifications.
+            if triggered && status.is_plugged_in && status.level > LOW_BATTERY_LEVEL {
+                triggered = false;
+                continue;
+            }
+            if !triggered && !status.is_plugged_in && status.level <= LOW_BATTERY_LEVEL {
+                notification_channel
+                    .send(Notification::new(
+                        NotificationType::LowBattery,
+                        "Rayhunter's battery is low".to_string(),
+                        None,
+                    ))
+                    .await
+                    .expect("Failed to send to notification channel");
+                triggered = true;
+            }
+        }
+    });
+}
@@ -0,0 +1,28 @@
+use std::path::Path;
+
+use crate::{
+    battery::{BatteryState, is_plugged_in_from_file},
+    error::RayhunterError,
+};
+
+const BATTERY_LEVEL_FILE: &str = "/sys/kernel/chg_info/level";
+const PLUGGED_IN_STATE_FILE: &str = "/sys/kernel/chg_info/chg_en";
+
+pub async fn get_battery_state() -> Result<BatteryState, RayhunterError> {
+    Ok(BatteryState {
+        level: match tokio::fs::read_to_string(&BATTERY_LEVEL_FILE)
+            .await
+            .map_err(RayhunterError::TokioError)?
+            .chars()
+            .next()
+        {
+            Some('1') => Ok(10),
+            Some('2') => Ok(25),
+            Some('3') => Ok(50),
+            Some('4') => Ok(75),
+            Some('5') => Ok(100),
+            _ => Err(RayhunterError::BatteryLevelParseError),
+        }?,
+        is_plugged_in: is_plugged_in_from_file(Path::new(PLUGGED_IN_STATE_FILE)).await?,
+    })
+}
@@ -0,0 +1,16 @@
+use std::path::Path;
+
+use crate::{
+    battery::{BatteryState, get_level_from_percentage_file, is_plugged_in_from_file},
+    error::RayhunterError,
+};
+
+const BATTERY_LEVEL_FILE: &str = "/sys/class/power_supply/bms/capacity";
+const PLUGGED_IN_STATE_FILE: &str = "/sys/devices/78d9000.usb/power_supply/usb/online";
+
+pub async fn get_battery_state() -> Result<BatteryState, RayhunterError> {
+    Ok(BatteryState {
+        level: get_level_from_percentage_file(Path::new(BATTERY_LEVEL_FILE)).await?,
+        is_plugged_in: is_plugged_in_from_file(Path::new(PLUGGED_IN_STATE_FILE)).await?,
+    })
+}
@@ -0,0 +1,17 @@
+use std::path::Path;
+
+use crate::{
+    battery::{BatteryState, get_level_from_percentage_file, is_plugged_in_from_file},
+    error::RayhunterError,
+};
+
+const BATTERY_LEVEL_FILE: &str =
+    "/sys/devices/78b7000.i2c/i2c-3/3-0063/power_supply/cw2017-bat/capacity";
+const PLUGGED_IN_STATE_FILE: &str = "/sys/devices/8a00000.ssusb/power_supply/usb/online";
+
+pub async fn get_battery_state() -> Result<BatteryState, RayhunterError> {
+    Ok(BatteryState {
+        level: get_level_from_percentage_file(Path::new(BATTERY_LEVEL_FILE)).await?,
+        is_plugged_in: is_plugged_in_from_file(Path::new(PLUGGED_IN_STATE_FILE)).await?,
+    })
+}
@@ -5,6 +5,7 @@ use rayhunter::Device;
 use rayhunter::analysis::analyzer::AnalyzerConfig;

 use crate::error::RayhunterError;
+use crate::notifications::NotificationType;

 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(default)]
@@ -17,6 +18,7 @@ pub struct Config {
    pub colorblind_mode: bool,
    pub key_input_mode: u8,
    pub ntfy_url: Option<String>,
+    pub enabled_notifications: Vec<NotificationType>,
    pub analyzers: AnalyzerConfig,
 }

@@ -32,6 +34,7 @@ impl Default for Config {
            key_input_mode: 0,
            analyzers: AnalyzerConfig::default(),
            ntfy_url: None,
+            enabled_notifications: vec![NotificationType::Warning, NotificationType::LowBattery],
        }
    }
 }
@@ -24,7 +24,7 @@ use rayhunter::qmdl::QmdlWriter;

 use crate::analysis::{AnalysisCtrlMessage, AnalysisWriter};
 use crate::display;
-use crate::notifications::Notification;
+use crate::notifications::{Notification, NotificationType};
 use crate::qmdl_store::{RecordingStore, RecordingStoreError};
 use crate::server::ServerState;

@@ -207,7 +207,7 @@ impl DiagTask {
                info!("a heuristic triggered on this run!");
                self.notification_channel
                    .send(Notification::new(
-                        "heuristic-warning".to_string(),
+                        NotificationType::Warning,
                        format!("Rayhunter has detected a {:?} severity event", max_type),
                        Some(Duration::from_secs(60 * 5)),
                    ))
@@ -9,9 +9,7 @@ use rayhunter::analysis::analyzer::EventType;

 use log::{error, info};
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
-use tokio::sync::oneshot::error::TryRecvError;
-use tokio_util::task::TaskTracker;
+use tokio_util::{sync::CancellationToken, task::TaskTracker};

 use include_dir::{Dir, include_dir};

@@ -173,7 +171,7 @@ pub fn update_ui(
    task_tracker: &TaskTracker,
    config: &config::Config,
    mut fb: impl GenericFramebuffer,
-    mut ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
    mut ui_update_rx: Receiver<DisplayState>,
 ) {
    static IMAGE_DIR: Dir<'_> = include_dir!("$CARGO_MANIFEST_DIR/images/");
@@ -204,13 +202,9 @@ pub fn update_ui(
            );
        }
        loop {
-            match ui_shutdown_rx.try_recv() {
-                Ok(_) => {
-                    info!("received UI shutdown");
-                    break;
-                }
-                Err(TryRecvError::Empty) => {}
-                Err(e) => panic!("error receiving shutdown message: {e}"),
+            if shutdown_token.is_cancelled() {
+                info!("received UI shutdown");
+                break;
            }
            match ui_update_rx.try_recv() {
                Ok(state) => {
@@ -1,6 +1,6 @@
 use log::info;
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;

 use crate::config;
@@ -9,7 +9,7 @@ use crate::display::DisplayState;
 pub fn update_ui(
    _task_tracker: &TaskTracker,
    _config: &config::Config,
-    _ui_shutdown_rx: oneshot::Receiver<()>,
+    _shutdown_token: CancellationToken,
    _ui_update_rx: Receiver<DisplayState>,
 ) {
    info!("Headless mode, not spawning UI.");
@@ -4,7 +4,7 @@ use crate::display::generic_framebuffer::{self, Dimensions, GenericFramebuffer};
 use async_trait::async_trait;

 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;

 const FB_PATH: &str = "/dev/fb0";
@@ -38,14 +38,14 @@ impl GenericFramebuffer for Framebuffer {
 pub fn update_ui(
    task_tracker: &TaskTracker,
    config: &config::Config,
-    ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
    ui_update_rx: Receiver<DisplayState>,
 ) {
    generic_framebuffer::update_ui(
        task_tracker,
        config,
        Framebuffer,
-        ui_shutdown_rx,
+        shutdown_token,
        ui_update_rx,
    )
 }
@@ -4,7 +4,7 @@
 /// DisplayState::WarningDetected { .. } => Signal LED slowly blinks red.
 use log::{error, info};
 use tokio::sync::mpsc;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;

 use std::time::Duration;
@@ -27,7 +27,7 @@ async fn stop_blinking(path: String) {
 pub fn update_ui(
    task_tracker: &TaskTracker,
    config: &config::Config,
-    mut ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
    mut ui_update_rx: mpsc::Receiver<DisplayState>,
 ) {
    let mut invisible: bool = false;
@@ -40,13 +40,9 @@ pub fn update_ui(
        let mut last_state = DisplayState::Paused;

        loop {
-            match ui_shutdown_rx.try_recv() {
-                Ok(_) => {
-                    info!("received UI shutdown");
-                    break;
-                }
-                Err(oneshot::error::TryRecvError::Empty) => {}
-                Err(e) => panic!("error receiving shutdown message: {e}"),
+            if shutdown_token.is_cancelled() {
+                info!("received UI shutdown");
+                break;
            }
            match ui_update_rx.try_recv() {
                Ok(new_state) => state = new_state,
@@ -1,6 +1,6 @@
 use log::info;
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;

 use crate::config;
@@ -11,7 +11,7 @@ use std::fs;
 pub fn update_ui(
    task_tracker: &TaskTracker,
    config: &config::Config,
-    ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
    ui_update_rx: Receiver<DisplayState>,
 ) {
    let display_level = config.ui_level;
@@ -23,9 +23,9 @@ pub fn update_ui(
    // The alternative would be to make the entire initialization async
    if fs::exists(tplink_onebit::OLED_PATH).unwrap_or_default() {
        info!("detected one-bit display");
-        tplink_onebit::update_ui(task_tracker, config, ui_shutdown_rx, ui_update_rx)
+        tplink_onebit::update_ui(task_tracker, config, shutdown_token, ui_update_rx)
    } else {
        info!("fallback to framebuffer");
-        tplink_framebuffer::update_ui(task_tracker, config, ui_shutdown_rx, ui_update_rx)
+        tplink_framebuffer::update_ui(task_tracker, config, shutdown_token, ui_update_rx)
    }
 }
@@ -2,13 +2,13 @@ use async_trait::async_trait;
 use std::os::fd::AsRawFd;
 use tokio::fs::OpenOptions;
 use tokio::io::AsyncWriteExt;
+use tokio_util::sync::CancellationToken;

 use crate::config;
 use crate::display::DisplayState;
 use crate::display::generic_framebuffer::{self, Dimensions, GenericFramebuffer};

 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
 use tokio_util::task::TaskTracker;

 const FB_PATH: &str = "/dev/fb0";
@@ -80,14 +80,14 @@ impl GenericFramebuffer for Framebuffer {
 pub fn update_ui(
    task_tracker: &TaskTracker,
    config: &config::Config,
-    ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
    ui_update_rx: Receiver<DisplayState>,
 ) {
    generic_framebuffer::update_ui(
        task_tracker,
        config,
        Framebuffer,
-        ui_shutdown_rx,
+        shutdown_token,
        ui_update_rx,
    )
 }
@@ -6,8 +6,7 @@ use crate::display::DisplayState;

 use log::{error, info};
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
-use tokio::sync::oneshot::error::TryRecvError;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;

 use std::time::Duration;
@@ -112,7 +111,7 @@ const STATUS_WARNING: &[u8] = pixelart! {
 pub fn update_ui(
    task_tracker: &TaskTracker,
    config: &config::Config,
-    mut ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
    mut ui_update_rx: Receiver<DisplayState>,
 ) {
    let display_level = config.ui_level;
@@ -124,13 +123,9 @@ pub fn update_ui(
        let mut pixels = STATUS_SMILING;

        loop {
-            match ui_shutdown_rx.try_recv() {
-                Ok(_) => {
-                    info!("received UI shutdown");
-                    break;
-                }
-                Err(TryRecvError::Empty) => {}
-                Err(e) => panic!("error receiving shutdown message: {e}"),
+            if shutdown_token.is_cancelled() {
+                info!("received UI shutdown");
+                break;
            }

            match ui_update_rx.try_recv() {
@@ -4,7 +4,7 @@
 /// DisplayState::WarningDetected => Signal LED is solid red.
 use log::{error, info};
 use tokio::sync::mpsc;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;

 use std::time::Duration;
@@ -27,7 +27,7 @@ async fn led_off(path: String) {
 pub fn update_ui(
    task_tracker: &TaskTracker,
    config: &config::Config,
-    mut ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
    mut ui_update_rx: mpsc::Receiver<DisplayState>,
 ) {
    let mut invisible: bool = false;
@@ -41,13 +41,9 @@ pub fn update_ui(
        let mut last_update = std::time::Instant::now();

        loop {
-            match ui_shutdown_rx.try_recv() {
-                Ok(_) => {
-                    info!("received UI shutdown");
-                    break;
-                }
-                Err(oneshot::error::TryRecvError::Empty) => {}
-                Err(e) => panic!("error receiving shutdown message: {e}"),
+            if shutdown_token.is_cancelled() {
+                info!("received UI shutdown");
+                break;
            }
            match ui_update_rx.try_recv() {
                Ok(new_state) => state = new_state,
@@ -10,7 +10,7 @@ use crate::display::generic_framebuffer::{self, Dimensions, GenericFramebuffer};
 use async_trait::async_trait;

 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;

 const FB_PATH: &str = "/dev/fb0";
@@ -43,14 +43,14 @@ impl GenericFramebuffer for Framebuffer {
 pub fn update_ui(
    task_tracker: &TaskTracker,
    config: &config::Config,
-    ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
    ui_update_rx: Receiver<DisplayState>,
 ) {
    generic_framebuffer::update_ui(
        task_tracker,
        config,
        Framebuffer,
-        ui_shutdown_rx,
+        shutdown_token,
        ui_update_rx,
    )
 }
@@ -15,4 +15,10 @@ pub enum RayhunterError {
    QmdlStoreError(#[from] RecordingStoreError),
    #[error("No QMDL store found at path {0}, but can't create a new one due to debug mode")]
    NoStoreDebugMode(String),
+    #[error("Error parsing file to determine battery level")]
+    BatteryLevelParseError,
+    #[error("Error parsing file to determine whether device is plugged in")]
+    BatteryPluggedInStatusParseError,
+    #[error("The requested functionality is not supported for this device")]
+    FunctionNotSupportedForDeviceError,
 }
@@ -3,7 +3,7 @@ use std::time::{Duration, Instant};
 use tokio::fs::File;
 use tokio::io::AsyncReadExt;
 use tokio::sync::mpsc::Sender;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;

 use crate::config;
@@ -21,7 +21,7 @@ pub fn run_key_input_thread(
    task_tracker: &TaskTracker,
    config: &config::Config,
    diag_tx: Sender<DiagDeviceCtrlMessage>,
-    mut ui_shutdown_rx: oneshot::Receiver<()>,
+    cancellation_token: CancellationToken,
 ) {
    if config.key_input_mode == 0 {
        return;
@@ -43,7 +43,7 @@ pub fn run_key_input_thread(

        loop {
            tokio::select! {
-                _ = &mut ui_shutdown_rx => {
+               _ = cancellation_token.cancelled() => {
                    info!("received key input shutdown");
                    return;
                }
@@ -1,4 +1,5 @@
 mod analysis;
+mod battery;
 mod config;
 mod diag;
 mod display;
@@ -12,8 +13,8 @@ mod stats;

 use std::net::SocketAddr;
 use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};

+use crate::battery::run_battery_notification_worker;
 use crate::config::{parse_args, parse_config};
 use crate::diag::run_diag_read_thread;
 use crate::error::RayhunterError;
@@ -39,11 +40,13 @@ use log::{error, info};
 use qmdl_store::RecordingStoreError;
 use rayhunter::Device;
 use rayhunter::diag_device::DiagDevice;
+use stats::get_log;
 use tokio::net::TcpListener;
 use tokio::select;
+use tokio::sync::RwLock;
 use tokio::sync::mpsc::{self, Sender};
-use tokio::sync::{RwLock, oneshot};
 use tokio::task::JoinHandle;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;

 type AppRouter = Router<Arc<ServerState>>;
@@ -55,6 +58,7 @@ fn get_router() -> AppRouter {
        .route("/api/zip/{name}", get(get_zip))
        .route("/api/system-stats", get(get_system_stats))
        .route("/api/qmdl-manifest", get(get_qmdl_manifest))
+        .route("/api/log", get(get_log))
        .route("/api/start-recording", post(start_recording))
        .route("/api/stop-recording", post(stop_recording))
        .route("/api/delete-recording/{name}", post(delete_recording))
@@ -75,7 +79,7 @@ fn get_router() -> AppRouter {
 async fn run_server(
    task_tracker: &TaskTracker,
    state: Arc<ServerState>,
-    server_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
 ) -> JoinHandle<()> {
    info!("spinning up server");
    let addr = SocketAddr::from(([0, 0, 0, 0], state.config.port));
@@ -85,17 +89,12 @@ async fn run_server(
    task_tracker.spawn(async move {
        info!("The orca is hunting for stingrays...");
        axum::serve(listener, app)
-            .with_graceful_shutdown(server_shutdown_signal(server_shutdown_rx))
+            .with_graceful_shutdown(shutdown_token.cancelled_owned())
            .await
            .unwrap();
    })
 }

-async fn server_shutdown_signal(server_shutdown_rx: oneshot::Receiver<()>) {
-    server_shutdown_rx.await.unwrap();
-    info!("Server received shutdown signal, exiting...");
-}
-
 // Loads a RecordingStore if one exists, and if not, only create one if we're
 // not in debug mode. If we fail to parse the manifest AND we're not in debug
 // mode, try to recover the manifest from the existing QMDL files
@@ -127,15 +126,10 @@ async fn init_qmdl_store(config: &config::Config) -> Result<RecordingStore, Rayh
 // Start a thread that'll track when user hits ctrl+c. When that happens,
 // trigger various cleanup tasks, including sending signals to other threads to
 // shutdown
-#[allow(clippy::too_many_arguments)]
 fn run_shutdown_thread(
    task_tracker: &TaskTracker,
    diag_device_sender: Sender<DiagDeviceCtrlMessage>,
-    daemon_restart_rx: oneshot::Receiver<()>,
-    should_restart_flag: Arc<AtomicBool>,
-    server_shutdown_tx: oneshot::Sender<()>,
-    maybe_ui_shutdown_tx: Option<oneshot::Sender<()>>,
-    maybe_key_input_shutdown_tx: Option<oneshot::Sender<()>>,
+    shutdown_token: CancellationToken,
    qmdl_store_lock: Arc<RwLock<RecordingStore>>,
    analysis_tx: Sender<AnalysisCtrlMessage>,
 ) -> JoinHandle<Result<(), RayhunterError>> {
@@ -147,17 +141,9 @@ fn run_shutdown_thread(
                if let Err(err) = res {
                    error!("Unable to listen for shutdown signal: {err}");
                }
-
-                should_restart_flag.store(false, Ordering::Relaxed);
            }
-            res = daemon_restart_rx => {
-                if let Err(err) = res {
-                    error!("Unable to listen for shutdown signal: {err}");
-                }
-
-                should_restart_flag.store(true, Ordering::Relaxed);
-            }
-        };
+            _ = shutdown_token.cancelled() => {}
+        }

        let mut qmdl_store = qmdl_store_lock.write().await;
        if qmdl_store.current_entry.is_some() {
@@ -166,15 +152,7 @@ fn run_shutdown_thread(
            info!("Done!");
        }

-        server_shutdown_tx
-            .send(())
-            .expect("couldn't send server shutdown signal");
-        if let Some(ui_shutdown_tx) = maybe_ui_shutdown_tx {
-            let _ = ui_shutdown_tx.send(());
-        }
-        if let Some(key_input_shutdown_tx) = maybe_key_input_shutdown_tx {
-            let _ = key_input_shutdown_tx.send(());
-        }
+        shutdown_token.cancel();
        diag_device_sender
            .send(DiagDeviceCtrlMessage::Exit)
            .await
@@ -191,9 +169,12 @@ fn run_shutdown_thread(
 async fn main() -> Result<(), RayhunterError> {
    env_logger::init();

-    rustls_rustcrypto::provider()
-        .install_default()
-        .expect("Couldn't install rustcrypto provider");
+    #[cfg(feature = "rustcrypto-tls")]
+    {
+        rustls_rustcrypto::provider()
+            .install_default()
+            .expect("Couldn't install rustcrypto provider");
+    }

    let args = parse_args();

@@ -220,14 +201,12 @@ async fn run_with_config(
    let (diag_tx, diag_rx) = mpsc::channel::<DiagDeviceCtrlMessage>(1);
    let (ui_update_tx, ui_update_rx) = mpsc::channel::<display::DisplayState>(1);
    let (analysis_tx, analysis_rx) = mpsc::channel::<AnalysisCtrlMessage>(5);
-    let mut maybe_ui_shutdown_tx = None;
-    let mut maybe_key_input_shutdown_tx = None;
+    let restart_token = CancellationToken::new();
+    let shutdown_token = restart_token.child_token();

    let notification_service = NotificationService::new(config.ntfy_url.clone());

    if !config.debug_mode {
-        let (ui_shutdown_tx, ui_shutdown_rx) = oneshot::channel();
-        maybe_ui_shutdown_tx = Some(ui_shutdown_tx);
        info!("Using configuration for device: {0:?}", config.device);
        let mut dev = DiagDevice::new(&config.device)
            .await
@@ -258,21 +237,17 @@ async fn run_with_config(
            Device::Pinephone => display::headless::update_ui,
            Device::Uz801 => display::uz801::update_ui,
        };
-        update_ui(&task_tracker, &config, ui_shutdown_rx, ui_update_rx);
+        update_ui(&task_tracker, &config, shutdown_token.clone(), ui_update_rx);

        info!("Starting Key Input service");
-        let (key_input_shutdown_tx, key_input_shutdown_rx) = oneshot::channel();
-        maybe_key_input_shutdown_tx = Some(key_input_shutdown_tx);
        key_input::run_key_input_thread(
            &task_tracker,
            &config,
            diag_tx.clone(),
-            key_input_shutdown_rx,
+            shutdown_token.clone(),
        );
    }

-    let (daemon_restart_tx, daemon_restart_rx) = oneshot::channel::<()>();
-    let (server_shutdown_tx, server_shutdown_rx) = oneshot::channel::<()>();
    let analysis_status_lock = Arc::new(RwLock::new(analysis_status));
    run_analysis_thread(
        &task_tracker,
@@ -281,20 +256,28 @@ async fn run_with_config(
        analysis_status_lock.clone(),
        config.analyzers.clone(),
    );
-    let should_restart_flag = Arc::new(AtomicBool::new(false));

    run_shutdown_thread(
        &task_tracker,
        diag_tx.clone(),
-        daemon_restart_rx,
-        should_restart_flag.clone(),
-        server_shutdown_tx,
-        maybe_ui_shutdown_tx,
-        maybe_key_input_shutdown_tx,
+        shutdown_token.clone(),
        qmdl_store_lock.clone(),
        analysis_tx.clone(),
    );
-    run_notification_worker(&task_tracker, notification_service);
+
+    run_battery_notification_worker(
+        &task_tracker,
+        config.device.clone(),
+        notification_service.new_handler(),
+        shutdown_token.clone(),
+    );
+
+    run_notification_worker(
+        &task_tracker,
+        notification_service,
+        config.enabled_notifications.clone(),
+    );
+
    let state = Arc::new(ServerState {
        config_path: args.config_path.clone(),
        config,
@@ -302,16 +285,16 @@ async fn run_with_config(
        diag_device_ctrl_sender: diag_tx,
        analysis_status_lock,
        analysis_sender: analysis_tx,
-        daemon_restart_tx: Arc::new(RwLock::new(Some(daemon_restart_tx))),
+        daemon_restart_token: restart_token.clone(),
        ui_update_sender: Some(ui_update_tx),
    });
-    run_server(&task_tracker, state, server_shutdown_rx).await;
+    run_server(&task_tracker, state, shutdown_token.clone()).await;

    task_tracker.close();
    task_tracker.wait().await;

    info!("see you space cowboy...");
-    Ok(should_restart_flag.load(Ordering::Relaxed))
+    Ok(restart_token.is_cancelled())
 }

 #[cfg(test)]
@@ -5,19 +5,30 @@ use std::{
 };

 use log::error;
+use serde::{Deserialize, Serialize};
 use tokio::sync::mpsc::{self, error::TryRecvError};
 use tokio_util::task::TaskTracker;

+#[derive(Hash, Eq, PartialEq, Debug, Clone, Serialize, Deserialize)]
+pub enum NotificationType {
+    Warning,
+    LowBattery,
+}
+
 pub struct Notification {
-    message_type: String,
+    notification_type: NotificationType,
    message: String,
    debounce: Option<Duration>,
 }

 impl Notification {
-    pub fn new(message_type: String, message: String, debounce: Option<Duration>) -> Self {
+    pub fn new(
+        notification_type: NotificationType,
+        message: String,
+        debounce: Option<Duration>,
+    ) -> Self {
        Notification {
-            message_type,
+            notification_type,
            message,
            debounce,
        }
@@ -52,6 +63,7 @@ impl NotificationService {
 pub fn run_notification_worker(
    task_tracker: &TaskTracker,
    mut notification_service: NotificationService,
+    enabled_notifications: Vec<NotificationType>,
 ) {
    task_tracker.spawn(async move {
        if let Some(url) = notification_service.url
@@ -65,8 +77,12 @@ pub fn run_notification_worker(
                loop {
                    match notification_service.rx.try_recv() {
                        Ok(notification) => {
+                            if !enabled_notifications.contains(&notification.notification_type) {
+                                continue;
+                            }
+
                            let status = notification_statuses
-                                .entry(notification.message_type)
+                                .entry(notification.notification_type)
                                .or_insert_with(|| NotificationStatus {
                                    message: "".to_string(),
                                    needs_sending: true,
@@ -13,10 +13,11 @@ use log::{error, warn};
 use std::sync::Arc;
 use tokio::fs::write;
 use tokio::io::{AsyncReadExt, copy, duplex};
+use tokio::sync::RwLock;
 use tokio::sync::mpsc::Sender;
-use tokio::sync::{RwLock, oneshot};
 use tokio_util::compat::FuturesAsyncWriteCompatExt;
 use tokio_util::io::ReaderStream;
+use tokio_util::sync::CancellationToken;

 use crate::DiagDeviceCtrlMessage;
 use crate::analysis::{AnalysisCtrlMessage, AnalysisStatus};
@@ -32,7 +33,7 @@ pub struct ServerState {
    pub diag_device_ctrl_sender: Sender<DiagDeviceCtrlMessage>,
    pub analysis_status_lock: Arc<RwLock<AnalysisStatus>>,
    pub analysis_sender: Sender<AnalysisCtrlMessage>,
-    pub daemon_restart_tx: Arc<RwLock<Option<oneshot::Sender<()>>>>,
+    pub daemon_restart_token: CancellationToken,
    pub ui_update_sender: Option<Sender<DisplayState>>,
 }

@@ -73,11 +74,6 @@ pub async fn serve_static(
    let path = path.trim_start_matches('/');

    match path {
-        "rayhunter_icon.png" => (
-            [(header::CONTENT_TYPE, HeaderValue::from_static("image/png"))],
-            include_bytes!("../web/build/rayhunter_icon.png"),
-        )
-            .into_response(),
        "rayhunter_orca_only.png" => (
            [(header::CONTENT_TYPE, HeaderValue::from_static("image/png"))],
            include_bytes!("../web/build/rayhunter_orca_only.png"),
@@ -133,24 +129,11 @@ pub async fn set_config(
    })?;

    // Trigger daemon restart after writing config
-    let mut restart_tx = state.daemon_restart_tx.write().await;
-    if let Some(sender) = restart_tx.take() {
-        sender.send(()).map_err(|_| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                "couldn't send restart signal".to_string(),
-            )
-        })?;
-        Ok((
-            StatusCode::ACCEPTED,
-            "wrote config and triggered restart".to_string(),
-        ))
-    } else {
-        Ok((
-            StatusCode::ACCEPTED,
-            "wrote config but restart already triggered".to_string(),
-        ))
-    }
+    state.daemon_restart_token.cancel();
+    Ok((
+        StatusCode::ACCEPTED,
+        "wrote config and triggered restart".to_string(),
+    ))
 }

 pub async fn get_zip(
@@ -331,7 +314,7 @@ mod tests {
            diag_device_ctrl_sender: tx,
            analysis_status_lock: Arc::new(RwLock::new(analysis_status)),
            analysis_sender: analysis_tx,
-            daemon_restart_tx: Arc::new(RwLock::new(None)),
+            daemon_restart_token: CancellationToken::new(),
            ui_update_sender: None,
        })
    }
@@ -1,7 +1,9 @@
 use std::sync::Arc;

-use crate::qmdl_store::ManifestEntry;
+use crate::battery::get_battery_status;
+use crate::error::RayhunterError;
 use crate::server::ServerState;
+use crate::{battery::BatteryState, qmdl_store::ManifestEntry};

 use axum::Json;
 use axum::extract::State;
@@ -16,6 +18,8 @@ pub struct SystemStats {
    pub disk_stats: DiskStats,
    pub memory_stats: MemoryStats,
    pub runtime_metadata: RuntimeMetadata,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub battery_status: Option<BatteryState>,
 }

 impl SystemStats {
@@ -24,6 +28,14 @@ impl SystemStats {
            disk_stats: DiskStats::new(qmdl_path, device).await?,
            memory_stats: MemoryStats::new(device).await?,
            runtime_metadata: RuntimeMetadata::new(),
+            battery_status: match get_battery_status(device).await {
+                Ok(status) => Some(status),
+                Err(RayhunterError::FunctionNotSupportedForDeviceError) => None,
+                Err(err) => {
+                    log::error!("Failed to get battery status: {err}");
+                    None
+                }
+            },
        })
    }
 }
@@ -156,3 +168,9 @@ pub async fn get_qmdl_manifest(
        current_entry,
    }))
 }
+
+pub async fn get_log() -> Result<String, (StatusCode, String)> {
+    tokio::fs::read_to_string("/data/rayhunter/rayhunter.log")
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))
+}
@@ -6,7 +6,7 @@
        <meta name="viewport" content="width=device-width, initial-scale=1" />
        %sveltekit.head%
    </head>
-    <body data-sveltekit-preload-data="hover">
+    <body data-sveltekit-preload-data="hover" style="width: 100%">
        <div style="display: contents" class="m-4 xl:m-8">%sveltekit.body%</div>
    </body>
 </html>
@@ -0,0 +1,24 @@
+export class ActionError extends Error {
+    // The number of this an identical error has happened.
+    // This is shown as a number next to the error in the UI.
+    times = $state(1);
+
+    constructor(message: string, cause: Error) {
+        super(message);
+        this.cause = cause;
+    }
+}
+
+export const action_errors: ActionError[] = $state([]);
+
+export function add_error(e: Error, msg: string): void {
+    for (const existing of action_errors) {
+        if (existing.message === msg) {
+            existing.times += 1;
+            return;
+        }
+    }
+    const action_error = new ActionError(msg, e);
+    action_errors.unshift(action_error);
+    console.log(action_errors.length);
+}
@@ -0,0 +1,100 @@
+<script lang="ts">
+    import { action_errors } from '../action_errors.svelte';
+
+    let pos = $state(0);
+    let current_error = $derived(action_errors[pos]);
+
+    function prev_error() {
+        if (pos > 0) pos -= 1;
+        else pos = action_errors.length - 1;
+    }
+    function next_error() {
+        if (pos + 1 < action_errors.length) pos += 1;
+        else pos = 0;
+    }
+    function clear_errors() {
+        pos = 0;
+        action_errors.length = 0;
+    }
+</script>
+
+{#if action_errors.length > 0}
+    <div
+        class="bg-red-100 border-red-100 drop-shadow p-4 flex flex-col gap-2
+        border rounded-md flex-1 justify-between fixed z-10 right-3 bottom-3 ml-3"
+    >
+        <div class="flex flex-row justify-between">
+            <span class="text-xl font-bold mb-2 mr-5 flex flex-row items-center gap-1 text-red-600">
+                <svg
+                    class="w-6 h-6 text-red-600"
+                    aria-hidden="true"
+                    xmlns="http://www.w3.org/2000/svg"
+                    width="24"
+                    height="24"
+                    fill="currentColor"
+                    viewBox="0 0 24 24"
+                >
+                    <path
+                        fill-rule="evenodd"
+                        d="M2 12C2 6.477 6.477 2 12 2s10 4.477 10 10-4.477 10-10 10S2 17.523 2 12Zm11-4a1 1 0 1 0-2 0v5a1 1 0 1 0 2 0V8Zm-1 7a1 1 0 1 0 0 2h.01a1 1 0 1 0 0-2H12Z"
+                        clip-rule="evenodd"
+                    />
+                </svg>
+                Error Completing Action {current_error.times > 1 ? `x${current_error.times}` : ''}
+            </span>
+            <div class="flex items-center mb-2">
+                {#if action_errors.length > 1}
+                    <span>{pos + 1}/{action_errors.length}</span>
+                    <button title="previous error" aria-label="previous error" onclick={prev_error}>
+                        <svg
+                            aria-hidden="true"
+                            width="24"
+                            height="24"
+                            fill="none"
+                            viewBox="0 0 24 24"
+                        >
+                            <path
+                                stroke="currentColor"
+                                stroke-linecap="round"
+                                stroke-linejoin="round"
+                                stroke-width="2"
+                                d="m 15.499979,19.499979 -6.9999997,-7 6.9999997,-6.9999997"
+                            />
+                        </svg>
+                    </button>
+                    <button title="next error" aria-label="next error" onclick={next_error}>
+                        <svg
+                            aria-hidden="true"
+                            width="24"
+                            height="24"
+                            fill="none"
+                            viewBox="0 0 24 24"
+                        >
+                            <path
+                                stroke="currentColor"
+                                stroke-linecap="round"
+                                stroke-linejoin="round"
+                                stroke-width="2"
+                                d="m 8.5000207,5.4999793 7.0000003,6.9999997 -7.0000003,7"
+                            />
+                        </svg>
+                    </button>
+                {/if}
+                <button title="clear errors" aria-label="clear errors" onclick={clear_errors}>
+                    <svg style="width:24px;height:24px" viewBox="0 0 24 24">
+                        <path
+                            d="M19,4H15.5L14.5,3H9.5L8.5,4H5V6H19M6,19A2,2 0 0,0 8,21H16A2,2 0 0,0 18,19V7H6V19Z"
+                        />
+                    </svg>
+                </button>
+            </div>
+        </div>
+        <span>{current_error.message}</span>
+        {#if current_error.cause}
+            <details>
+                <summary>Details</summary>
+                <code>{current_error.cause}</code>
+            </details>
+        {/if}
+    </div>
+{/if}
@@ -33,7 +33,7 @@
    {#if report.statistics.num_warnings === 0 && report.statistics.num_informational_logs === 0}
        <p>Nothing to show!</p>
    {:else}
-        <div class="overflow-x-scroll">
+        <div class="overflow-x-auto">
            <table class="table-auto text-left">
                <thead class="p-2">
                    <tr class="bg-gray-300">
@@ -77,10 +77,10 @@
    <div>
        <p class="text-lg underline">Unparsed Messages</p>
        <p>
-            These are due to a limitation or bug in Rayhunter's parser, and aren't ususally a
+            These are due to a limitation or bug in Rayhunter's parser, and aren't usually a
            problem.
        </p>
-        <div class="overflow-x-scroll">
+        <div class="overflow-x-auto">
            <table class="table-auto text-left">
                <thead class="p-2">
                    <tr class="bg-gray-300">
@@ -1,5 +1,5 @@
 <script lang="ts">
-    import { req } from '$lib/utils.svelte';
+    import { user_action_req } from '$lib/utils.svelte';

    let {
        url,
@@ -11,6 +11,7 @@
        icon,
        onclick,
        ariaLabel,
+        errorMessage,
    }: {
        url: string;
        method?: string;
@@ -21,6 +22,7 @@
        icon?: any; // Svelte snippet
        onclick?: () => void | Promise<void>;
        ariaLabel?: string;
+        errorMessage?: string;
    } = $props();

    let is_requesting = $state(false);
@@ -46,7 +48,11 @@

        is_requesting = true;
        try {
-            await req(method, url);
+            await user_action_req(
+                method,
+                url,
+                errorMessage ? errorMessage : 'Error performing action'
+            );
            if (onclick) {
                await onclick();
            }
@@ -111,18 +111,6 @@
                    </select>
                </div>

-                <div>
-                    <label for="ntfy_url" class="block text-sm font-medium text-gray-700 mb-1">
-                        ntfy URL for Sending Notifications
-                    </label>
-                    <input
-                        id="ntfy_url"
-                        type="url"
-                        bind:value={config.ntfy_url}
-                        class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
-                    />
-                </div>
-
                <div class="space-y-3">
                    <div class="flex items-center">
                        <input
@@ -137,6 +125,56 @@
                    </div>
                </div>

+                <div class="border-t pt-4 mt-6 space-y-3">
+                    <h3 class="text-lg font-semibold text-gray-800 mb-4">Notification Settings</h3>
+                    <div>
+                        <label for="ntfy_url" class="block text-sm font-medium text-gray-700 mb-1">
+                            ntfy URL for Sending Notifications (if unset you will not receive
+                            notifications)
+                        </label>
+                        <input
+                            id="ntfy_url"
+                            type="url"
+                            bind:value={config.ntfy_url}
+                            class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
+                        />
+                    </div>
+
+                    <div class="space-y-2">
+                        <div class="block text-sm font-medium text-gray-700 mb-1">
+                            Enabled Notification Types
+                        </div>
+                        <div class="flex items-center">
+                            <input
+                                type="checkbox"
+                                id="enable_warning_notifications"
+                                value="Warning"
+                                bind:group={config.enabled_notifications}
+                            />
+                            <label
+                                for="enable_warning_notifications"
+                                class="ml-2 block text-sm text-gray-700"
+                            >
+                                Warnings
+                            </label>
+                        </div>
+                        <div class="flex items-center">
+                            <input
+                                type="checkbox"
+                                id="enable_lowbattery_notifications"
+                                value="LowBattery"
+                                bind:group={config.enabled_notifications}
+                            />
+                            <label
+                                for="enable_lowbattery_notifications"
+                                class="ml-2 block text-sm text-gray-700"
+                            >
+                                Low Battery
+                            </label>
+                        </div>
+                    </div>
+                </div>
+
                <div class="border-t pt-4 mt-6">
                    <h3 class="text-lg font-semibold text-gray-800 mb-4">
                        Analyzer Heuristic Settings
@@ -7,5 +7,6 @@
        text="Delete ALL Recordings"
        prompt={`Are you sure you want to delete ALL recordings?`}
        url={`/api/delete-all-recordings`}
+        name="all recodings"
    />
 </div>
@@ -1,18 +1,20 @@
 <script lang="ts">
-    import { req } from '$lib/utils.svelte';
+    import { user_action_req } from '$lib/utils.svelte';
    let {
        text,
        url,
        prompt,
+        name,
    }: {
        text?: string;
        url: string;
        prompt: string;
+        name: string;
    } = $props();

    function confirmDelete() {
        if (window.confirm(prompt)) {
-            req('POST', url);
+            user_action_req('POST', url, 'Unable to delete recording ' + name);
        }
    }
 </script>
@@ -0,0 +1,74 @@
+<script lang="ts">
+    import { get_logs } from '$lib/utils.svelte';
+    import { onMount } from 'svelte';
+
+    let { shown = $bindable() }: { shown: boolean } = $props();
+    let content: string | undefined = $state(undefined);
+
+    onMount(() => {
+        // Used by LogView modal
+        window.addEventListener('scroll', () => {
+            document.documentElement.style.setProperty('--scroll-y', `${window.scrollY}px`);
+        });
+    });
+
+    $effect(() => {
+        if (shown) {
+            const scrollY = document.documentElement.style.getPropertyValue('--scroll-y');
+            const body = document.body;
+            body.style.position = 'fixed';
+            body.style.top = `-${scrollY}`;
+        } else {
+            const body = document.body;
+            const scrollY = body.style.top;
+            body.style.position = '';
+            body.style.top = '';
+            window.scrollTo(0, parseInt(scrollY || '0') * -1);
+        }
+
+        const interval = setInterval(async () => {
+            try {
+                // Don't update UI if browser tab isn't visible
+                if (content !== undefined && (document.hidden || !shown)) {
+                    return;
+                }
+                content = await get_logs();
+            } catch (error) {
+                console.log(error);
+            }
+        }, 1000);
+
+        return () => clearInterval(interval);
+    });
+</script>
+
+{#if shown}
+    <div
+        class="fixed left-5 right-5 top-5 bottom-5 z-50 bg-white border border-white rounded-md
+		flex flex-col p-2 drop-shadow"
+    >
+        <div class="flex h-20 justify-between items-center p-1">
+            <span class="text-2xl mb-2">Log</span>
+            <button onclick={() => (shown = false)} aria-label="close">
+                <svg
+                    xmlns="http://www.w3.org/2000/svg"
+                    aria-hidden="true"
+                    width="24"
+                    height="24"
+                    fill="currentColor"
+                    viewBox="0 0 24 24"
+                >
+                    <path
+                        fill-rule="evenodd"
+                        clip-rule="evenodd"
+                        d="M5.29289 5.29289C5.68342 4.90237 6.31658 4.90237 6.70711 5.29289L12 10.5858L17.2929 5.29289C17.6834 4.90237 18.3166 4.90237 18.7071 5.29289C19.0976 5.68342 19.0976 6.31658 18.7071 6.70711L13.4142 12L18.7071 17.2929C19.0976 17.6834 19.0976 18.3166 18.7071 18.7071C18.3166 19.0976 17.6834 19.0976 17.2929 18.7071L12 13.4142L6.70711 18.7071C6.31658 19.0976 5.68342 19.0976 5.29289 18.7071C4.90237 18.3166 4.90237 17.6834 5.29289 17.2929L10.5858 12L5.29289 6.70711C4.90237 6.31658 4.90237 5.68342 5.29289 5.29289Z"
+                        fill="#0F1729"
+                    />
+                </svg>
+            </button>
+        </div>
+        <div class="bg-gray-100 border border-gray-100 rounded-md overflow-scroll">
+            <pre class="m-2">{content}</pre>
+        </div>
+    </div>
+{/if}
@@ -44,7 +44,7 @@
 </script>

 <div
-    class="{status_row_color} {status_border_color} drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 overflow-x-scroll overflow-y-hidden"
+    class="{status_row_color} {status_border_color} drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 overflow-x-auto overflow-y-hidden"
 >
    {#if current}
        <div class="flex flex-row justify-between gap-2">
@@ -81,7 +81,7 @@
                'N/A'}</span
        >
    </div>
-    <div class="flex flex-row justify-between lg:justify-end gap-1 mt-2 overflow-x-scroll">
+    <div class="flex flex-row justify-between lg:justify-end gap-1 mt-2 overflow-x-auto">
        <DownloadLink url={entry.get_pcap_url()} text="pcap" full_button />
        <DownloadLink url={entry.get_qmdl_url()} text="qmdl" full_button />
        <DownloadLink url={entry.get_zip_url()} text="zip" full_button />
@@ -91,6 +91,7 @@
            <DeleteButton
                prompt={`Are you sure you want to delete entry ${entry.name}?`}
                url={entry.get_delete_url()}
+                name={entry.name}
            />
        {/if}
    </div>
@@ -60,6 +60,7 @@
            <DeleteButton
                prompt={`Are you sure you want to delete entry ${entry.name}?`}
                url={entry.get_delete_url()}
+                name={entry.name}
            />
        </td>
    {/if}
@@ -35,6 +35,7 @@
    variant="blue"
    onclick={handleReAnalyze}
    ariaLabel="re-analyze"
+    errorMessage="Error re-analyzing recoding"
 >
    {#snippet icon()}
        <svg style="width:20px;height:20px" viewBox="0 0 24 24">
@@ -1,6 +1,5 @@
 <script lang="ts">
    import ApiRequestButton from './ApiRequestButton.svelte';
-
    let {
        server_is_recording,
    }: {
@@ -10,7 +9,12 @@

 <div>
    {#if server_is_recording}
-        <ApiRequestButton url="/api/stop-recording" label="Stop" variant="red">
+        <ApiRequestButton
+            url="/api/stop-recording"
+            label="Stop"
+            variant="red"
+            errorMessage="Error stoppping recording"
+        >
            {#snippet icon()}
                <svg
                    class="w-6 h-6 text-white"
@@ -28,7 +32,12 @@
            {/snippet}
        </ApiRequestButton>
    {:else}
-        <ApiRequestButton url="/api/start-recording" label="Start" variant="blue">
+        <ApiRequestButton
+            url="/api/start-recording"
+            label="Start"
+            variant="blue"
+            errorMessage="Error starting recording"
+        >
            {#snippet icon()}
                <svg
                    class="w-6 h-6 text-white"
@@ -7,6 +7,32 @@
    } = $props();

    const table_cell_classes = 'border p-1 lg:p-2';
+
+    let battery_level = $derived(stats.battery_status ? stats.battery_status.level : 0);
+    let bar_color = $derived.by(() => {
+        if (stats.battery_status === undefined) {
+            return '';
+        }
+        if (battery_level <= 10) {
+            return 'fill-red-500';
+        }
+        if (battery_level <= 25) {
+            return 'fill-yellow-300';
+        }
+        return 'fill-green-500';
+    });
+    let title_text = $derived.by(() => {
+        if (stats.battery_status === undefined) {
+            return 'Rayhunter does not yet support displaying the battery level for this device.';
+        }
+
+        let text = `Battery is ${stats.battery_status.level}% full`;
+
+        if (stats.battery_status.is_plugged_in) {
+            text += ' and plugged in';
+        }
+        return text;
+    });
 </script>

 <div
@@ -32,6 +58,64 @@
                    Free: {stats.memory_stats.free}, Used: {stats.memory_stats.used}
                </td>
            </tr>
+            <tr class="border-b">
+                <th class={table_cell_classes}> Battery </th>
+                <td class={table_cell_classes}>
+                    <svg
+                        width="80"
+                        height="30"
+                        viewBox="0 0 80 30"
+                        role="img"
+                        xmlns="http://www.w3.org/2000/svg"
+                        class="battery-icon"
+                    >
+                        <title>{title_text}</title>
+                        <!-- Battery body -->
+                        <rect
+                            class="fill-none stroke-neutral-800 stroke-2"
+                            width="70"
+                            height="30"
+                            rx="3"
+                            ry="3"
+                        />
+                        <!-- Battery terminal -->
+                        <rect
+                            class="fill-neutral-800"
+                            x="70"
+                            y="7"
+                            width="8"
+                            height="16"
+                            rx="2"
+                            ry="2"
+                        />
+                        <!-- Battery charge bar -->
+                        <rect
+                            class={bar_color}
+                            x="2"
+                            y="2"
+                            height="26"
+                            rx="2"
+                            ry="2"
+                            style="width: {battery_level * 0.66}px;"
+                        />
+                        {#if stats.battery_status && stats.battery_status.is_plugged_in}
+                            <!-- Lightning bolt icon -->
+                            <path
+                                class="fill-yellow-300 stroke-neutral-800 stroke-1"
+                                d="M38 3 L28 17 L34 17 L30 27 L40 13 L34 13 Z"
+                            />
+                        {/if}
+                        {#if !stats.battery_status}
+                            <!-- Question mark icon -->
+                            <text
+                                class="fill-neutral-500 text-[20px] font-bold [text-anchor:middle] [dominant-baseline:central]"
+                                x="35"
+                                y="15">?</text
+                            >
+                        {/if}
+                    </svg>
+                </td>
+            </tr>
        </tbody>
    </table>
 </div>
@@ -2,6 +2,7 @@ export interface SystemStats {
    disk_stats: DiskStats;
    memory_stats: MemoryStats;
    runtime_metadata: RuntimeMetadata;
+    battery_status?: BatteryStatus;
 }

 export interface RuntimeMetadata {
@@ -24,3 +25,8 @@ export interface MemoryStats {
    used: string;
    free: string;
 }
+
+export interface BatteryStatus {
+    level: number;
+    is_plugged_in: boolean;
+}
@@ -1,3 +1,4 @@
+import { add_error } from './action_errors.svelte';
 import { Manifest } from './manifest.svelte';
 import type { SystemStats } from './systemStats';

@@ -11,11 +12,17 @@ export interface AnalyzerConfig {
    test_analyzer: boolean;
 }

+export enum enabled_notifications {
+    Warning = 'Warning',
+    LowBattery = 'LowBattery',
+}
+
 export interface Config {
    ui_level: number;
    colorblind_mode: boolean;
    key_input_mode: number;
    ntfy_url: string;
+    enabled_notifications: enabled_notifications[];
    analyzers: AnalyzerConfig;
 }

@@ -31,6 +38,23 @@ export async function req(method: string, url: string): Promise<string> {
    }
 }

+// A wrapper around req that reports errors to the UI
+export async function user_action_req(
+    method: string,
+    url: string,
+    error_msg: string
+): Promise<string | undefined> {
+    try {
+        return await req(method, url);
+    } catch (error) {
+        if (error instanceof Error) {
+            console.log('beeeo');
+            add_error(error, error_msg);
+        }
+        return undefined;
+    }
+}
+
 export async function get_manifest(): Promise<Manifest> {
    const manifest_json = JSON.parse(await req('GET', '/api/qmdl-manifest'));
    return new Manifest(manifest_json);
@@ -40,6 +64,10 @@ export async function get_system_stats(): Promise<SystemStats> {
    return JSON.parse(await req('GET', '/api/system-stats'));
 }

+export async function get_logs(): Promise<string> {
+    return await req('GET', '/api/log');
+}
+
 export async function get_config(): Promise<Config> {
    return JSON.parse(await req('GET', '/api/config'));
 }
@@ -7,34 +7,101 @@
    import { AnalysisManager } from '$lib/analysisManager.svelte';
    import SystemStatsTable from '$lib/components/SystemStatsTable.svelte';
    import DeleteAllButton from '$lib/components/DeleteAllButton.svelte';
-    import RecordingControls from '$lib/components//RecordingControls.svelte';
+    import RecordingControls from '$lib/components/RecordingControls.svelte';
    import ConfigForm from '$lib/components/ConfigForm.svelte';
+    import ActionErrors from '$lib/components/ActionErrors.svelte';
+    import LogView from '$lib/components/LogView.svelte';

    let manager: AnalysisManager = new AnalysisManager();
    let loaded = $state(false);
+    let filter_threshold: boolean = $state(false);
    let entries: ManifestEntry[] = $state([]);
    let current_entry: ManifestEntry | undefined = $state(undefined);
    let system_stats: SystemStats | undefined = $state(undefined);
+    let update_error: string | undefined = $state(undefined);
+    let logview_shown: boolean = $state(false);
    $effect(() => {
        const interval = setInterval(async () => {
-            await manager.update();
-            let new_manifest = await get_manifest();
-            await new_manifest.set_analysis_status(manager);
-            entries = new_manifest.entries;
-            current_entry = new_manifest.current_entry;
+            try {
+                // Don't update UI if browser tab isn't visible
+                if (document.hidden) {
+                    return;
+                }

-            system_stats = await get_system_stats();
-            loaded = true;
+                await manager.update();
+                let new_manifest = await get_manifest();
+                await new_manifest.set_analysis_status(manager);
+                entries = filter_threshold
+                    ? new_manifest.entries.filter((e) => e.get_num_warnings())
+                    : new_manifest.entries;
+
+                current_entry = new_manifest.current_entry;
+
+                system_stats = await get_system_stats();
+                update_error = undefined;
+                loaded = true;
+            } catch (error) {
+                if (error instanceof Error) {
+                    update_error = error.message;
+                } else {
+                    update_error = '';
+                }
+            }
        }, 1000);

        return () => clearInterval(interval);
    });
 </script>

+<LogView bind:shown={logview_shown} />
 <div class="p-4 xl:px-8 bg-rayhunter-blue drop-shadow flex flex-row justify-between items-center">
    <!-- https://www.w3.org/WAI/tutorials/images/decorative/ -->
    <img src="/rayhunter_text.png" alt="" class="h-10 xl:h-12" />
    <div class="flex flex-row gap-4">
+        <button onclick={() => (logview_shown = true)} class="flex flex-row gap-1 group">
+            <span class="hidden text-white group-hover:text-gray-400 lg:flex">Logs</span>
+            <svg
+                class="w-6 h-6 text-white group-hover:text-gray-400"
+                aria-hidden="true"
+                xmlns="http://www.w3.org/2000/svg"
+                width="24"
+                height="24"
+                fill="currentColor"
+                viewBox="0 0 24 24"
+            >
+                <path
+                    d="M10 14H3"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                />
+                <path
+                    d="M10 18H3"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                />
+                <path
+                    d="M14 15L17.5 18L21 15"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                />
+                <path
+                    d="M3 6L13.5 6M20 6L17.75 6"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                />
+                <path
+                    d="M20 10L9.5 10M3 10H5.25"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                />
+            </svg>
+        </button>
        <a
            class="flex flex-row gap-1 group"
            href="https://github.com/EFForg/rayhunter/issues"
@@ -84,6 +151,41 @@
    </div>
 </div>
 <div class="m-4 xl:mx-8 flex flex-col gap-4">
+    {#if update_error !== undefined}
+        <div
+            class="bg-red-100 border-red-100 drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 justify-between"
+        >
+            <span class="text-2xl font-bold mb-2 flex flex-row items-center gap-2 text-red-600">
+                <svg
+                    class="w-8 h-8 text-red-600"
+                    aria-hidden="true"
+                    xmlns="http://www.w3.org/2000/svg"
+                    width="24"
+                    height="24"
+                    fill="currentColor"
+                    viewBox="0 0 24 24"
+                >
+                    <path
+                        fill-rule="evenodd"
+                        d="M2 12C2 6.477 6.477 2 12 2s10 4.477 10 10-4.477 10-10 10S2 17.523 2 12Zm11-4a1 1 0 1 0-2 0v5a1 1 0 1 0 2 0V8Zm-1 7a1 1 0 1 0 0 2h.01a1 1 0 1 0 0-2H12Z"
+                        clip-rule="evenodd"
+                    />
+                </svg>
+                Connection Error
+            </span>
+            <span
+                >This webpage is not currently receiving updates from your Rayhunter device. This
+                could be do loss of connection or some issue with your device.</span
+            >
+            {#if update_error}
+                <details>
+                    <summary>Error</summary>
+                    <code>{update_error}</code>
+                </details>
+            {/if}
+        </div>
+    {/if}
+    <ActionErrors />
    {#if loaded}
        <div class="flex flex-col lg:flex-row gap-4">
            {#if current_entry}
@@ -117,9 +219,9 @@
                        </svg>
                        WARNING: Not Running
                    </span>
-                    <span
-                        >Rayhunter is not currently running and will not detect abnormal behavior!</span
-                    >
+                    <span>
+                        Rayhunter is not currently running and will not detect abnormal behavior!
+                    </span>
                    <div class="flex flex-row justify-end mt-2">
                        <RecordingControls server_is_recording={!!current_entry} />
                    </div>
@@ -128,7 +230,23 @@
            <SystemStatsTable stats={system_stats!} />
        </div>
        <div class="flex flex-col gap-2">
-            <span class="text-xl">History</span>
+            <div class="flex flex-row gap-2">
+                <div class="text-xl flex-1">History</div>
+                <div class="flex flex-row items-center gap-2 px-3">
+                    <label
+                        for="filter_threshold"
+                        class="block text-md font-medium text-gray-700 mb-1"
+                    >
+                        Filter for Warnings
+                    </label>
+                    <input
+                        type="checkbox"
+                        id="filter_threshold"
+                        bind:checked={filter_threshold}
+                        class="px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
+                    />
+                </div>
+            </div>
            <ManifestTable {entries} server_is_recording={!!current_entry} {manager} />
        </div>
        <DeleteAllButton />
@@ -23,7 +23,9 @@ ui_level = 1
 key_input_mode = 0

 # If set, attempts to send a notification to the url when a new warning is triggered
-# ntfy_url =
+ntfy_url = ""
+# What notification types to enable. Does nothing if the above ntfy_url is not set.
+enabled_notifications = ["Warning", "LowBattery"]

 # Analyzer Configuration
 # Enable/disable specific IMSI catcher detection heuristics
@@ -35,4 +37,4 @@ lte_sib6_and_7_downgrade = true
 null_cipher = true
 nas_null_cipher = true
 incomplete_sib = true
-test_analyzer = false
+test_analyzer = false
@@ -10,9 +10,10 @@
 - [Uninstalling](./uninstalling.md)
 - [Using Rayhunter](./using-rayhunter.md)
  - [Rayhunter's heuristics](./heuristics.md)
+  - [Re-analyzing recordings](./reanalyzing.md)
  - [How we analyze a capture](./analyzing-a-capture.md)
 - [Supported devices](./supported-devices.md)
-  - [Orbic RC400L](./orbic.md)
+  - [Orbic/Kajeet RC400L](./orbic.md)
  - [TP-Link M7350](./tplink-m7350.md)
  - [TP-Link M7310](./tplink-m7310.md)
  - [Tmobile TMOHS1](./tmobile-tmohs1.md)
@@ -1,3 +1,3 @@
 # How we analyze a capture

-TODO
+Teams of highly trained squirrels. Video coming soon!
@@ -12,9 +12,12 @@ Through web UI you can set:
  - *EFF logo*, which shows EFF logo and *and* colored line.
 - **Device Input Mode**, which defines behaviour of built-in power button of the device. *Device Input Mode* could be:
  - *Disable button control*: built-in power button of the device is not used by Rayhunter;
-  - *Double-tap power button to start/stop recording*: double clicking on a built-in power button of the device stops and immediatelly restarts the recording. This could be useful if Rayhunter's heuristichs is triggered and you get the red line, and you want to "reset" the past warnings. Normally you can do that through web UI, but sometimes it is easier to double tap on power button.
- **ntfy URL for Sending Notifications**, which allows setting a [ntfy](https://ntfy.sh/) URL to which notifications of new detections will be sent. The topic should be unique to your device, e.g., `https://ntfy.sh/rayhunter_notifications_ba9di7ie` or `https://myserver.example.com/rayhunter_notifications_ba9di7ie`. The ntfy Android and iOS apps can then be used to receive notifications. More information can be found in the [ntfy docs](https://docs.ntfy.sh/).
+  - *Double-tap power button to start/stop recording*: double clicking on a built-in power button of the device stops and immediately restarts the recording. This could be useful if Rayhunter's heuristichs is triggered and you get the red line, and you want to "reset" the past warnings. Normally you can do that through web UI, but sometimes it is easier to double tap on power button.
 - **Colorblind Mode** enables color blind mode (blue line is shown instead of green line, red line remains red). Please note that this does not cover all types of color blindness, but switching green to blue should be about enough to differentiate the color change for most types of color blindness.
+- **ntfy URL**, which allows setting a [ntfy](https://ntfy.sh/) URL to which notifications of new detections will be sent. The topic should be unique to your device, e.g., `https://ntfy.sh/rayhunter_notifications_ba9di7ie` or `https://myserver.example.com/rayhunter_notifications_ba9di7ie`. The ntfy Android and iOS apps can then be used to receive notifications. More information can be found in the [ntfy docs](https://docs.ntfy.sh/).
+- **Enabled Notification Types** allows enabling or disabling the following types of notifications:
+  - *Warnings*, which will alert when a heuristic is triggered. Alerts will be sent at most once every five minutes.
+  - *Low Battery*, which will alert when the device's battery is low. Notifications may not be supported for all devices—you can check if your device is supported by looking at whether the battery level indicator is functioning on the System Information section of the Rayhunter UI.
 - With **Analyzer Heuristic Settings** you can switch on or off built-in [Rayhunter heuristics](heuristics.md). Some heuristics are experimental or can trigger a lot of false positive warnings in some networks (our tests have shown that some heuristics have different behaviour in US or European networks). In that case you can decide whether you would like to have the heuristics that trigger a lot of false positives on or off. Please note that we are constantly improving and adding new heuristics, so new release may reduce false positives in existing heuristics as well.

 If you prefer editing `config.toml` file, you need to obtain a shell on your [Orbic](./orbic.md#obtaining-a-shell) or [TP-Link](./tplink-m7350.md#obtaining-a-shell) device and edit the file manually. You can view the [default configuration file on a GitHub](https://github.com/EFForg/rayhunter/blob/main/dist/config.toml.in).
@@ -2,23 +2,25 @@

 ### Do I need an active SIM card to use Rayhunter?

-**It Depends**. Operation of Rayhunter does require the insertion of a SIM card into the device, but whether that SIM card has to be currently active for our tests to work is still under investigation. If you want to use the device as a hotspot in addition to a research device an active plan would of course be necessary, however we have not done enough testing yet to know whether an active subscription is required for detection. If you want to test the device with an inactive SIM card, we would certainly be interested in seeing any data you collect, and especially any runs that trigger an alert!
+**It Depends**. Operation of Rayhunter does require the insertion of a SIM card into the device, but that sim card does not have to be actively registered with a service plan. If you want to use the device as a hotspot in addition to a research device, or get [notifications](./configuration.md), an active plan would of course be necessary.
+
+### How can I test that my device is working?
+You can enable the `Test Heuristic` under `Analyzer Heuristic Settings` in the config section on your web dashboard. This will cause an alert to trigger every time your device sees a cell tower, you might need to reboot your device or move around a bit to get this one to trigger, but it will be very noisey once it does. People have also tested it by building IMSI catchers at home, but we don't recommend that, since it violates FCC regulations and will probably upset your neighbors.

 <a name="red"></a>

-### Help, Rayhunter's line is red! What should I do?
+### Help, Rayhunter's line is red/orange/yellow/dotted/dashed! What should I do?

-Unfortunately, the circumstances that might lead to a positive cell site simulator (CSS) signal are quite varied, so we don't have a universal recommendation for how to deal with the a positive signal. Depending on your circumstances and threat model, you may want to turn off your phone until you are out of the area (or put it on airplane mode) and tell your friends to do the same!
+Unfortunately, the circumstances that might lead to a positive cell site simulator (CSS) signal are quite varied, so we don't have a universal recommendation for how to deal with the a positive signal. Depending on your circumstances and threat model, you may want to turn off your phone until you are out of the area and tell your friends to do the same!

-If you've received a Rayhunter warning and would like to help us with our research, please send your Rayhunter data captures (QMDL and PCAP logs) to us at our [Signal](https://signal.org/) username [**ElectronicFrontierFoundation.90**](https://signal.me/#eu/HZbPPED5LyMkbTxJsG2PtWc2TXxPUR1OxBMcJGLOPeeCDGPuaTpOi5cfGRY6RrGf) with the following information: capture date, capture location, device, device model, and Rayhunter version. If you're unfamiliar with Signal, feel free to check out our [Security Self Defense guide on it](https://ssd.eff.org/module/how-to-use-signal).
+If you've received a Rayhunter warning and would like to help us with our research, please send your Rayhunter data captures (Zip file downloaded from the web interface) to us at our [Signal](https://signal.org/) username [**ElectronicFrontierFoundation.90**](https://signal.me/#eu/HZbPPED5LyMkbTxJsG2PtWc2TXxPUR1OxBMcJGLOPeeCDGPuaTpOi5cfGRY6RrGf) with the following information: capture date, capture location, device, device model, and Rayhunter version. If you're unfamiliar with Signal, feel free to check out our [Security Self Defense guide on it](https://ssd.eff.org/module/how-to-use-signal).

 Please note that this file may contain sensitive information such as your IMSI and the unique IDs of cell towers you were near which could be used to ascertain your location at the time.


 ### Should I get a locked or unlocked orbic device? What is the difference?

-If you want to use a non-Verizon SIM card you will probably need an unlocked device. But it's not clear how locked the locked devices are nor how to unlock them, we welcome any experimentation and information regarding the use of unlocked devices.
-
+If you want to use a non-Verizon SIM card you will probably need an unlocked device. But it's not clear which devices are locked nor how to unlock them, we welcome any experimentation and information regarding the use of unlocked devices. So far most verizon branded orbic devices we have encountered are actually unlocked.

 ### How do I re-enable USB tethering after installing Rayhunter?

@@ -4,23 +4,40 @@ Rayhunter includes several analyzers to detect potential IMSI catcher activity.

 ## Available Analyzers

-### IMSI Requested
+### IMSI Requested (v3)

-This analyser tests whether the eNodeB sends an IMSI Identity Request NAS message.
+This analyser tests whether the eNodeB sends an IMSI or IMEI Identity Request NAS message under suspicious .

-Mobile network primarily requests IMSI number from mobile device during initial network attachment or when the network cannot identify the mobile device by its temporary identification (TMSI - *Temporary Mobile Subscriber Identity* or GUTI - *Globally Unique Temporary Identifier* in 4G/5G terminology).
+Mobile networks primarily request IMSI or IMEI from a mobile device during initial network attachment or when the network cannot identify the mobile device by its temporary identification (TMSI - *Temporary Mobile Subscriber Identity* or GUTI - *Globally Unique Temporary Identifier* in 4G/5G terminology).

 IMSI request therefore usually happens when you first turn the device on especially after it has been off for a long time. Another possibility is, that you reboot your mobile device and your temporary ID expired. Sometimes temporary identification can expire if you have been in an area where there is absolutely no connection to your service provider or after you left your device on an airplane mode and then reconnect to the network (especially being disconnected for a long time). IMSI could also be requested when you connect to a new network (for instance for roaming), when you swap she SIM card or when your device moves to a new *Tracking Area* or *Location Area* and the network can not map the temporary identification to your device. IMSI number can also be requested after core network reboot.

 It should also be noted that the network periodically reassigns your device new temporary identification to enhance security and avoid tracking, but in that cases usually does not request IMSI.

-However, if you get this warning at a time when you have been steadily connected to towers and the device has been on for a while, this could be a sign of IMSI catcher use.
+During these events the phone will typically go on to authenticate that the network is legitimate and then establish service with the network it is connected to. 
+
+What we consider suspicious is the following chain of events:
+
+* Phone connects to a new tower. 
+* Tower asks for phones identity (IMEI or IMSI.)
+* Authentication does *NOT* happen. 
+* Tower requests phone to disconnect. 
+
+Looking for this chain of events is much less prone to false positives than naively looking for any time the IMSI/IMEI is sent. We do still sometimes get false positives when users are in an airplane that is coming in for a landing however. This is likely do to having been disconnected for a while and then being over towers that are not able to route to your home network, but we are still researching.
+
+This is the attack used by commercial IMSI catchers used by law enforcement. 
+
+This heuristic will also alert you if any of the following happen:
+* Identity is requested after authentication.
+* Identity is requested without your phone connecting to the tower. 
+* Identity is requested and then authentication doesn't happen shortly thereafter. 
+
+This heuristic will also issue a notification every time your identity is sent to the network under non suspicious circumstances. This is for diagnostic purposes. 

 ### Connection Release/Redirected Carrier 2G Downgrade

-This analyser tests if a base station releases your device's connection and redirects your device to a 2G base station. This heuristics is useful, because many commercial IMSI catchers operate in a such way that they downgrade connection to 2G where they can intercept the communication (by performing man-in-the-middle attack).
+This analyser tests if a base station releases your device's connection and redirects your device to a 2G base station. This heuristic is useful, because some IMSI catchers may operate in a such way that they downgrade connection to 2G where they can intercept the communication (by performing man-in-the-middle attack).

-This heuristic is the most useful in the United States or other countries where there are no more operating 2G base stations. See [Wikipedia page on past 2G networks](https://en.wikipedia.org/wiki/2G#Past_2G_networks) for information about your country. In countries where 2G is still in service (such as most of EU), this heuristics may trigger false positives. In that case you should consider disabling it. However this heuristics has been vastly improved to reduce false positive warnings and new tests in European networks show that false positives are vastly reduced.

 ### LTE SIB6/7 Downgrade

@@ -28,10 +45,12 @@ This analyser tests if LTE base station is broadcasting a SIB type 6 and 7 messa

 SIB (*System Information Block*) Type 6 and 7 are specific types of broadcast messages sent by the base station (eNodeB in 4G networks) to mobile devices. They contain essential radio-related configuration parameters to help mobile device perform cell reselection.

-IMSI catchers exploit the fact that many SIB broadcast messages are not encrypted or authenticated. This allows them to pretend to be a legitimate cell by broadcasting fake system information in order to force mobile devices to downgrade from more secure 4G (LTE) to less secure 2G (GSM) network and then steal IMSI and/or perform man-in-the-middle attack. That is why this is also called a downgrade attack.
+This attack exploits the fact that SIB broadcast messages are not encrypted or authenticated. This allows them to pretend to be a legitimate cell by broadcasting fake system information in order to force mobile devices to downgrade from more secure 4G (LTE) to less secure 2G (GSM) network and then steal IMSI and/or perform man-in-the-middle attack. That is why this is also called a downgrade attack.

 SIB6 is used for cell reselecion to CDMA2000 systems which are not supported by many modern mobile phones, and SIB7 Provides the mobile device with information to perform cell reselection to GSM/EDGE networks. Therefore SIB6 messages are quite rare, while malformed SIB7 messages are much more frequent in practice. 

+This heuristic is the most useful in the United States or other countries where there are no more operating 2G base stations. See [Wikipedia page on past 2G networks](https://en.wikipedia.org/wiki/2G#Past_2G_networks) for information about your country. In countries where 2G is still in service (such as most of EU), this heuristics may trigger false positives. In that case you should consider disabling it. However this heuristics has been vastly improved to reduce false positive warnings and new tests in European networks show that false positives are vastly reduced.
+
 ### Null Cipher

 This analyser tests whether the cell suggests using a null cipher (EEA0) in the RRC layer. That means that encryption between your mobile device and base station is turned off.
@@ -56,4 +75,4 @@ On its own this might just be a misconfigured base station (though we have only

 ### Test Analyzer

-This analyzer is great for testing if your Rayhunter installation works. It will alert every time a new tower is seen (specifically every time a tower broadcasts a SIB1 message.) It is designed to be very noisey so we do not reccomend leaving it on but if this alerts it means your Rayhunter device is working! 
+This analyzer is great for testing if your Rayhunter installation works. It will alert every time a new tower is seen (specifically every time a tower broadcasts a SIB1 message.) It is designed to be very noisey so we do not recommend leaving it on but if this alerts it means your Rayhunter device is working! 
@@ -14,7 +14,7 @@ Windows support in Rayhunter's installer is a work-in-progress. Depending on the

 <div class=warning><strong>

-[The Windows installer is known to be buggy](https://github.com/EFForg/rayhunter/issues/366). Consider using the [Network-based installer](./orbic.md#the-network-installer).
+[The Windows USB installer is known to be buggy](https://github.com/EFForg/rayhunter/issues/366). We strongly recommend using the [Network-based installer](./orbic.md#the-network-installer).

 </strong></div>

@@ -21,6 +21,7 @@ Make sure you've got one of Rayhunter's [supported devices](./supported-devices.
 4. Turn on your device by holding the power button on the front.

   * For the Orbic, connect the device using a USB-C cable.
+     * Or connect to the network if using the network based installer, this is especially recommended on Windows.
   * For TP-Link, connect to its network using either WiFi or USB Tethering.

 5. Run the installer:
@@ -32,8 +33,7 @@ Make sure you've got one of Rayhunter's [supported devices](./supported-devices.
    Then run the installer:
    ```bash
    ./installer orbic
-    # or: ./installer tplink
-    # or: ./installer wingtech
+    # or: ./installer [orbic-network|tplink|tmobile|uz801|pinephone|wingtech]
    ```

    The device will restart multiple times over the next few minutes.
@@ -44,6 +44,10 @@ Make sure you've got one of Rayhunter's [supported devices](./supported-devices.

 ## Troubleshooting

+* If you are having trouble installing Rayhunter and you're connecting to your device over USB, try using a different USB cable to connect the device to your computer. If you are using a USB hub, try using a different one or directly connecting the device to a USB port on your computer. A faulty USB connection can cause the Rayhunter installer to fail.
+
+* You can test your device by enabling the test heuristic. This will be very noisy and fire an alert every time you see a new tower. Be sure to turn it off when you are done testing.  
+
 * On MacOS if you encounter an error that says "No Orbic device found," it may because you have the "Allow accessories to connect" security setting set to "Ask for approval." You may need to temporarily change it to "Always" for the script to run. Make sure to change it back to a more secure setting when you're done.

 ```bash
@@ -36,21 +36,28 @@ rustup target add x86_64-pc-windows-gnu
 Now you can root your device and install Rayhunter by running:

 ```sh
-# Profile can be changed to 'firmware-devel' when building for development.
-# Build time will decrease at the expense of binary size.
-cargo build --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile firmware
+# Build the daemon binary for local development (rustcrypto TLS backend, fast compilation)
+# WARNING: The rustcrypto library, though not known to be insecure, is less well
+# tested than its counterpart and could potentially have severe issues in
+# its cryptographic implementation. We therefore recommend using ring-tls in
+# production builds (see below)
+cargo build-daemon-firmware-devel

-cargo build --bin rootshell --target armv7-unknown-linux-musleabihf --profile firmware
+# To build it exactly like in CI (more mature ring TLS backend, slower compilation)
+# CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc cargo build-daemon-firmware
+
+# Build rootshell
+cargo build -p rootshell --bin rootshell --target armv7-unknown-linux-musleabihf --profile firmware

 # Replace 'orbic' with your device type if different.
-# A list possible values can be found with 'cargo run --bin installer help'.
-cargo run --bin installer orbic
+# A list of possible values can be found with 'cargo run --bin installer help'.
+cargo run -p installer --bin installer orbic
 ```

 ### If you're on Windows or can't run the install scripts

 * Root your device on Windows using the instructions here: <https://xdaforums.com/t/resetting-verizon-orbic-speed-rc400l-firmware-flash-kajeet.4334899/#post-87855183>
-* Build the web UI using `cd bin/web && npm install && npm run build`
+* Build the web UI using `cd daemon/web && npm install && npm run build`
 * Push the scripts in `scripts/` to `/etc/init.d` on device and make a directory called `/data/rayhunter` using `adb shell` (and sshell for your root shell if you followed the steps above)
 * You also need to copy `config.toml.in` to `/data/rayhunter/config.toml`. Uncomment the `device` line and set the value to your device type if necessary.
 * Then run `./make.sh`, which will build the binary, push it over adb, and restart the device. Once it's restarted, Rayhunter should be running!
@@ -2,11 +2,14 @@

 <img style="display: block; margin: 0 auto" alt="Rayhunter Logo - An Orca taking a bite out of a cellular signal bar" src="https://www.eff.org/files/styles/media_browser_preview/public/banner_library/rayhunter-banner.png" />

-Rayhunter is a project for detecting IMSI catchers, also known as cell-site simulators or stingrays. It's designed to run on a cheap mobile hotspot called the Orbic RC400L, but thanks to community efforts can [support some other devices as well](./supported-devices.md).
-
+Rayhunter is a project for detecting IMSI catchers, also known as cell-site simulators or stingrays. It was first designed to run on a cheap mobile hotspot called the Orbic RC400L, but thanks to community efforts can [support some other devices as well](./supported-devices.md).
 It's also designed to be as easy to install and use as possible, regardless of your level of technical skills. This guide should provide you all you need to acquire a compatible device, install Rayhunter, and start catching IMSI catchers.

-To learn more about the aim of the project, and about IMSI catchers in general, please check out our [introductory blog post](https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying). Otherwise, check out the [installation guide](./installation.md) to get started.
+&rarr;  Check out the [installation guide](./installation.md) to get started.
+
+&rarr; To learn more about the aim of the project, and about IMSI catchers in general, please check out our [introductory blog post](https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying). 
+
+&rarr; For discussion, help, or to join the mattermost channel and get involved with the project and community check out the [many ways listed here](./support-feedback-community.md)!

 **LEGAL DISCLAIMER:** Use this program at your own risk. We believe running this program does not currently violate any laws or regulations in the United States. However, we are not responsible for civil or criminal liability resulting from the use of this software. If you are located outside of the US please consult with an attorney in your country to help you assess the legal risks of running this program.

@@ -1,7 +1,9 @@
-# Orbic RC400L
+# Orbic/Kajeet RC400L

 The Orbic RC400L is an inexpensive LTE modem primarily designed for the US market, and the original device for which Rayhunter is developed.

+It is also sometimes sold under the brand Kajeet RC400L. This is the exact same hardware and can be treated the same. 
+
 You can buy an Orbic [using bezos
 bucks](https://www.amazon.com/Orbic-Verizon-Hotspot-Connect-Enabled/dp/B08N3CHC4Y),
 or on [eBay](https://www.ebay.com/sch/i.html?_nkw=orbic+rc400l).
@@ -27,13 +29,15 @@ procedure at `./installer orbic-network` that is supposed to eventually replace
 identically on Windows, Mac and Linux. From our testing it works much more
 reliably on Windows than `./installer orbic` does.

-The drawback is that the device's admin password is required. If you have a Kajeet-branded "SmartSpot" you currently have to use the USB-based `./installer orbic`, as we currently don't know of a way to get that admin password.
+The drawback is that the device's admin password is required. 

 1. Connect to the Orbic's network via WiFi or USB tethering
 2. Run `./installer orbic-network`
 3. The installer will ask you to log into the admin UI on `localhost:4000`. The password for that is the same as the WiFi password.
 4. As soon as you're logged in, the installer will continue and reboot the device.

+*note*: On Kajeet devices the default admin password is `$m@rt$p0tc0nf!g`, on most other orbic devices the default admin password is the same as the wifi password. If the password has been changed you can reset it by pressing the button under the back case until the unit restarts. 
+
 ## Obtaining a shell

 After running through the installation procedure, you can obtain a root shell
@@ -0,0 +1,45 @@
+# Re-analyzing recordings
+
+Every once in a while, Rayhunter refines its heuristics to detect more kinds of
+suspicious behavior, and to reduce noise from incorrect alerts.
+
+This means that your old green recordings may actually contain data that is now
+deemed suspicious, and also old red recordings may become green.
+
+You can re-analyze any old recording inside of Rayhunter by clicking on "N
+warnings" to expand details, then clicking the "re-analyze" button.
+
+## Analyzing recordings on Desktop
+
+If you have a PCAP or QMDL file but no rayhunter, you can analyze it on desktop
+using the `rayhunter-check` CLI tool. That tool contains the same heuristics as
+Rayhunter and will also work on traffic data captured with other tools, such as
+QCSuper.
+
+Since, 0.6.1, `rayhunter-check` is included in the release zipfile.
+
+You can build `rayhunter-check` from source with the following command:
+`cargo build --bin rayhunter-check` 
+
+## Usage
+```sh
+rayhunter-check [OPTIONS] --path <PATH>
+
+Options:
+  -p, --path <PATH>   Path to the PCAP, or QMDL file. If given a directory will 
+                        recursively scan all pcap, qmdl, and subdirectories 
+  -P, --pcapify       Turn QMDL file into PCAP     
+      --show-skipped  Show skipped messages
+  -q, --quiet         Print only warnings
+  -d, --debug         Print debug info 
+  -h, --help          Print help
+  -V, --version       Print version
+```
+### Examples 
+`rayhunter-check -p ~/Downloads/myfile.qmdl`
+
+`rayhunter-check -p ~/Downloads/myfile.pcap`
+
+`rayhunter-check -p ~/Downloads #Check all files in downloads`
+
+`rayhunter-check -d -p ~/Downloads/myfile.qmdl #run in debug mode`
@@ -7,7 +7,7 @@ These devices have been extensively tested by the core developers and are widely

 | Device | Recommended region |
 | ------ | ------ |
-| [Orbic RC400L](./orbic.md) | Americas |
+| [Orbic RC400L](./orbic.md) Sometimes also branded Kajeet RC400L | Americas |
 | [TP-Link M7350](./tplink-m7350.md) | Africa, Europe, Middle East |

 The TP-Link M7350 also works in the Americas but is usually more expensive.
@@ -52,7 +52,7 @@ If your device has a one-bit (black-and-white) display, Rayhunter will instead s
 ## Power-saving mode/sleep

 By default the device will go to sleep after N minutes of no devices being connected. In that mode it will also turn off connections to cell phone towers.
-In order for Rayhunter to record continuously, you have to turn off this sleep mode in TP-Link's admin panel (go to **Advanced** - **Power Saving**) or keep e.g. your phone connectd on the TP-Link's WiFi.
+In order for Rayhunter to record continuously, you have to turn off this sleep mode in TP-Link's admin panel (go to **Advanced** - **Power Saving**) or keep e.g. your phone connected on the TP-Link's WiFi.

 ## Port triggers

@@ -1,6 +1,6 @@
 # Using Rayhunter

-Once installed, Rayhunter will run automatically whenever your device is running. You'll see a green line on top of the device's display to indicate that it's running and recording. [The line will turn red](./faq.md#red) once a potential IMSI catcher has been found, until the device is rebooted or a new recording is started through the web UI.
+Once installed, Rayhunter will run automatically whenever your device is running. You'll see a green line on top of the device's display to indicate that it's running and recording. [The line will turn yellow dots, orange dashes, or solid red](./faq.md#red) once a potential IMSI catcher has been found, depending on the severity of the alert, until the device is rebooted or a new recording is started through the web UI.

 ![Rayhunter_0 5 0](./Rayhunter_0.5.0.png)

@@ -28,4 +28,4 @@ You can access this UI in one of two ways:

 ## Key shortcuts

-As of Rayhunter verion 0.3.3, you can start a new recording by double-tapping the power button. Any current recording will be stopped and a new recording will be started, resetting the red line as well. This feature is disabled by default since Rayhunter version 0.4.0 and needs to be enabled through [configuration](./configuration.md).
+As of Rayhunter version 0.3.3, you can start a new recording by double-tapping the power button. Any current recording will be stopped and a new recording will be started, resetting the red line as well. This feature is disabled by default since Rayhunter version 0.4.0 and needs to be enabled through [configuration](./configuration.md).
@@ -1,6 +1,6 @@
 [package]
 name = "installer"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2024"

 [dependencies]
@@ -104,7 +104,16 @@ async fn tplink_run_install(
    println!("Connecting via telnet to {admin_ip}");
    let addr = SocketAddr::from_str(&format!("{admin_ip}:23")).unwrap();

-    if !skip_sdcard {
+    if skip_sdcard {
+        sdcard_path = "/data/rayhunter-data".to_owned();
+        telnet_send_command(
+            addr,
+            &format!("mkdir -p {sdcard_path}"),
+            "exit code 0",
+            true,
+        )
+        .await?
+    } else {
        if sdcard_path.is_empty() {
            let try_paths = [
                // TP-Link hardware less than v9.0
@@ -263,9 +272,19 @@ async fn handler(state: State<AppState>, mut req: Request) -> Result<Response, S
        let mut data = BytesMut::from(data);
        // inject some javascript into the admin UI to get us a telnet shell.
        data.extend(br#";window.rayhunterPoll = window.setInterval(() => {
-            Globals.models.PTModel.add({applicationName: "rayhunter-root", enableState: 1, entryId: 1, openPort: "2300-2400", openProtocol: "TCP", triggerPort: "$(busybox telnetd -l /bin/sh)", triggerProtocol: "TCP"});
+            // Intentionally register rayhunter-daemon before rayhunter-root so that we are less
+            // likely to run into race conditions where rayhunter-root is launched, and the
+            // installer kills the server. In practice both HTTP requests may execute concurrently
+            // anyway.
            Globals.models.PTModel.add({applicationName: "rayhunter-daemon", enableState: 1, entryId: 2, openPort: "2400-2500", openProtocol: "TCP", triggerPort: "$(/etc/init.d/rayhunter_daemon start)", triggerProtocol: "TCP"});
-            alert("Success! You can go back to the rayhunter installer.");
+            Globals.models.PTModel.add({applicationName: "rayhunter-root", enableState: 1, entryId: 1, openPort: "2300-2400", openProtocol: "TCP", triggerPort: "$(busybox telnetd -l /bin/sh)", triggerProtocol: "TCP"});
+
+            // Do not use alert(), instead replace page with success message. Using alert() will
+            // block the event loop in such a way that any background promises are blocked from
+            // progress too. For example: The HTTP requests to register our port triggers!
+            document.body.innerHTML = "<h1>Success! You can go back to the rayhunter installer.</h1>";
+
+            // We can stop polling now, presumably both requests are already inflight.
            window.clearInterval(window.rayhunterPoll);
        }, 1000);"#);
        response = Response::from_parts(parts, Body::from(Bytes::from(data)));
@@ -276,6 +295,16 @@ async fn handler(state: State<AppState>, mut req: Request) -> Result<Response, S
 }

 async fn tplink_launch_telnet_v5(admin_ip: &str) -> Result<(), Error> {
+    let addr = SocketAddr::from_str(&format!("{admin_ip}:23")).unwrap();
+
+    if telnet_send_command(addr, "true", "exit code 0", true)
+        .await
+        .is_ok()
+    {
+        println!("telnet already appears to be running");
+        return Ok(());
+    }
+
    let client: HttpProxyClient =
        hyper_util::client::legacy::Client::<(), ()>::builder(TokioExecutor::new())
            .build(HttpConnector::new());
@@ -297,8 +326,6 @@ async fn tplink_launch_telnet_v5(admin_ip: &str) -> Result<(), Error> {

    let handle = tokio::spawn(async move { axum::serve(listener, app).await });

-    let addr = SocketAddr::from_str(&format!("{admin_ip}:23")).unwrap();
-
    while telnet_send_command(addr, "true", "exit code 0", true)
        .await
        .is_err()
@@ -306,6 +333,9 @@ async fn tplink_launch_telnet_v5(admin_ip: &str) -> Result<(), Error> {
        sleep(Duration::from_millis(1000)).await;
    }

+    // give the JavaScript code some additional time to run and persist the port triggers.
+    sleep(Duration::from_millis(1000)).await;
+
    handle.abort();

    Ok(())
@@ -1,6 +1,6 @@
 [package]
 name = "rayhunter"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2024"
 description = "Realtime cellular data decoding and analysis for IMSI catcher detection"

@@ -124,7 +124,11 @@ pub trait Analyzer {
    /// heuristic deems it relevant. Again, be mindful of any state your
    /// [Analyzer] updates per message, since it may be run over hundreds or
    /// thousands of them alongside many other [Analyzers](Analyzer).
-    fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<Event>;
+    fn analyze_information_element(
+        &mut self,
+        ie: &InformationElement,
+        packet_num: usize,
+    ) -> Option<Event>;

    /// Returns a version number for this Analyzer. This should only ever
    /// increase in value, and do so whenever substantial changes are made to
@@ -296,6 +300,7 @@ impl<'de> Deserialize<'de> for AnalysisRow {

 pub struct Harness {
    analyzers: Vec<Box<dyn Analyzer + Send>>,
+    packet_num: usize,
 }

 impl Default for Harness {
@@ -308,6 +313,7 @@ impl Harness {
    pub fn new() -> Self {
        Self {
            analyzers: Vec::new(),
+            packet_num: 0,
        }
    }

@@ -328,15 +334,15 @@ impl Harness {
        }

        if analyzer_config.nas_null_cipher {
-            harness.add_analyzer(Box::new(NasNullCipherAnalyzer::new()))
+            harness.add_analyzer(Box::new(NasNullCipherAnalyzer {}))
        }

        if analyzer_config.incomplete_sib {
-            harness.add_analyzer(Box::new(IncompleteSibAnalyzer::new()))
+            harness.add_analyzer(Box::new(IncompleteSibAnalyzer {}))
        }

        if analyzer_config.test_analyzer {
-            harness.add_analyzer(Box::new(TestAnalyzer::new()))
+            harness.add_analyzer(Box::new(TestAnalyzer {}))
        }

        harness
@@ -347,6 +353,8 @@ impl Harness {
    }

    pub fn analyze_pcap_packet(&mut self, packet: EnhancedPacketBlock) -> AnalysisRow {
+        self.packet_num += 1;
+
        let epoch = DateTime::parse_from_rfc3339("1980-01-06T00:00:00-00:00").unwrap();
        let mut row = AnalysisRow {
            packet_timestamp: Some(epoch + packet.timestamp),
@@ -383,6 +391,8 @@ impl Harness {
    pub fn analyze_qmdl_messages(&mut self, container: MessagesContainer) -> Vec<AnalysisRow> {
        let mut rows = Vec::new();
        for maybe_qmdl_message in container.into_messages() {
+            self.packet_num += 1;
+
            rows.push(AnalysisRow {
                packet_timestamp: None,
                skipped_message_reason: None,
@@ -424,10 +434,21 @@ impl Harness {
        rows
    }

-    pub fn analyze_information_element(&mut self, ie: &InformationElement) -> Vec<Option<Event>> {
+    fn analyze_information_element(&mut self, ie: &InformationElement) -> Vec<Option<Event>> {
+        // This method is private because incrementing packet_num is currently handled entirely by the other
+        // methods that call this one. This could be changed with some careful refactoring, but
+        // while this method is only used by other Harness methods, let's keep it private to help
+        // ensure we always bump packet_num exactly once for each processed packet.
+        let packet_str = format!(" (packet {})", self.packet_num);
        self.analyzers
            .iter_mut()
-            .map(|analyzer| analyzer.analyze_information_element(ie))
+            .map(|analyzer| {
+                let mut maybe_event = analyzer.analyze_information_element(ie, self.packet_num);
+                if let Some(ref mut event) = maybe_event {
+                    event.message.push_str(&packet_str);
+                }
+                maybe_event
+            })
            .collect()
    }

@@ -25,7 +25,11 @@ impl Analyzer for ConnectionRedirect2GDowngradeAnalyzer {
        1
    }

-    fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<Event> {
+    fn analyze_information_element(
+        &mut self,
+        ie: &InformationElement,
+        _packet_num: usize,
+    ) -> Option<Event> {
        if let InformationElement::LTE(lte_ie) = ie
            && let LteInformationElement::DlDcch(msg_cont) = &**lte_ie
            && let DL_DCCH_MessageType::C1(c1) = &msg_cont.message
@@ -23,7 +23,6 @@ pub enum State {
 }

 pub struct ImsiRequestedAnalyzer {
-    packet_num: usize,
    state: State,
    timeout_counter: usize,
    flag: Option<Event>,
@@ -38,33 +37,36 @@ impl Default for ImsiRequestedAnalyzer {
 impl ImsiRequestedAnalyzer {
    pub fn new() -> Self {
        Self {
-            packet_num: 0,
            state: State::Unattached,
            timeout_counter: 0,
            flag: None,
        }
    }

-    fn transition(&mut self, next_state: State) {
+    fn transition(&mut self, next_state: State, packet_num: usize) {
        match (&self.state, &next_state) {
            // Reset timeout on successful auth
            (_, State::AuthAccept) => {
                debug!(
                    "reset timeout counter at {} due to auth accept (frame {})",
-                    self.timeout_counter, self.packet_num
+                    self.timeout_counter, packet_num
                );
                self.timeout_counter = 0;
            }

-            // Unexpected IMSI without AttachRequest
-            (current, State::IdentityRequest) if *current != State::AttachRequest => {
+            // IMSI or IMEI requested after auth accept
+            (State::AuthAccept, State::IdentityRequest) => {
                self.flag = Some(Event {
                    event_type: EventType::High,
-                    message: format!(
-                        "Identity requested without Attach Request (frame {})",
-                        self.packet_num
-                    )
-                    .to_string(),
+                    message: "Identity requested after auth request".to_string(),
+                });
+            }
+
+            // Unexpected IMSI without AttachRequest
+            (State::Disconnect, State::IdentityRequest) => {
+                self.flag = Some(Event {
+                    event_type: EventType::High,
+                    message: "Identity requested without Attach Request".to_string(),
                });
            }

@@ -72,11 +74,15 @@ impl ImsiRequestedAnalyzer {
            (State::IdentityRequest, State::Disconnect) => {
                self.flag = Some(Event {
                    event_type: EventType::High,
-                    message: format!(
-                        "Disconnected after Identity Request without Auth Accept (frame {})",
-                        self.packet_num
-                    )
-                    .to_string(),
+                    message: "Disconnected after Identity Request without Auth Accept".to_string(),
+                });
+            }
+
+            // Notify on any identity reqeust (IMEI or IMSI)
+            (_, State::IdentityRequest) => {
+                self.flag = Some(Event {
+                    event_type: EventType::Informational,
+                    message: "Identity Request happened but its not suspicious yet.".to_string(),
                });
                self.timeout_counter = 0;
            }
@@ -85,7 +91,7 @@ impl ImsiRequestedAnalyzer {
            _ => {
                debug!(
                    "Transition from {:?} to {:?} at {}",
-                    self.state, next_state, self.packet_num
+                    self.state, next_state, packet_num
                );
            }
        }
@@ -105,32 +111,34 @@ impl Analyzer for ImsiRequestedAnalyzer {
    }

    fn get_version(&self) -> u32 {
-        2
+        3
    }

-    fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<Event> {
-        self.packet_num += 1;
-
+    fn analyze_information_element(
+        &mut self,
+        ie: &InformationElement,
+        packet_num: usize,
+    ) -> Option<Event> {
        if let InformationElement::LTE(inner) = ie {
            match &**inner {
                LteInformationElement::NAS(payload) => match payload {
                    NASMessage::EMMMessage(EMMMessage::EMMExtServiceRequest(_))
                    | NASMessage::EMMMessage(EMMMessage::EMMAttachRequest(_)) => {
-                        self.transition(State::AttachRequest);
+                        self.transition(State::AttachRequest, packet_num);
                    }
                    NASMessage::EMMMessage(EMMMessage::EMMIdentityRequest(_)) => {
-                        self.transition(State::IdentityRequest);
+                        self.transition(State::IdentityRequest, packet_num);
                    }
                    NASMessage::EMMMessage(EMMMessage::EMMAttachComplete(_))
                    | NASMessage::EMMMessage(EMMMessage::EMMAuthenticationResponse(_)) => {
-                        self.transition(State::AuthAccept);
+                        self.transition(State::AuthAccept, packet_num);
                    }
                    NASMessage::EMMMessage(EMMMessage::EMMServiceReject(_))
                    | NASMessage::EMMMessage(EMMMessage::EMMAttachReject(_))
                    | NASMessage::EMMMessage(EMMMessage::EMMDetachRequestMO(_))
                    | NASMessage::EMMMessage(EMMMessage::EMMDetachRequestMT(_))
                    | NASMessage::EMMMessage(EMMMessage::EMMTrackingAreaUpdateReject(_)) => {
-                        self.transition(State::Disconnect);
+                        self.transition(State::Disconnect, packet_num);
                    }
                    _ => {}
                },
@@ -140,7 +148,7 @@ impl Analyzer for ImsiRequestedAnalyzer {
                    | UL_CCCH_MessageType::C1(
                        UL_CCCH_MessageType_c1::RrcConnectionReestablishmentRequest(_),
                    ) => {
-                        self.transition(State::AttachRequest);
+                        self.transition(State::AttachRequest, packet_num);
                    }
                    _ => {}
                },
@@ -150,7 +158,7 @@ impl Analyzer for ImsiRequestedAnalyzer {
                        _,
                    )) = rrc_payload.message
                    {
-                        self.transition(State::Disconnect)
+                        self.transition(State::Disconnect, packet_num)
                    }
                }
                _ => {}
@@ -161,16 +169,12 @@ impl Analyzer for ImsiRequestedAnalyzer {
            self.timeout_counter += 1;
            debug!(
                "timeout: counter {}, packet: {}",
-                self.timeout_counter, self.packet_num
+                self.timeout_counter, packet_num
            );
            if self.timeout_counter >= TIMEOUT_THRESHHOLD {
                self.flag = Some(Event {
                    event_type: EventType::Informational {},
-                    message: format!(
-                        "Identity request happened without auth request followup (frame {})",
-                        self.packet_num
-                    )
-                    .to_string(),
+                    message: "Identity request happened without auth request followup".to_string(),
                });
                self.timeout_counter = 0;
            }
@@ -5,21 +5,7 @@ use telcom_parser::lte_rrc::{BCCH_DL_SCH_MessageType, BCCH_DL_SCH_MessageType_c1
 use super::analyzer::{Analyzer, Event, EventType};
 use super::information_element::{InformationElement, LteInformationElement};

-pub struct IncompleteSibAnalyzer {
-    packet_num: usize,
-}
-
-impl Default for IncompleteSibAnalyzer {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl IncompleteSibAnalyzer {
-    pub fn new() -> Self {
-        Self { packet_num: 0 }
-    }
-}
+pub struct IncompleteSibAnalyzer {}

 impl Analyzer for IncompleteSibAnalyzer {
    fn get_name(&self) -> Cow<'_, str> {
@@ -31,12 +17,14 @@ impl Analyzer for IncompleteSibAnalyzer {
    }

    fn get_version(&self) -> u32 {
-        1
+        2
    }

-    fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<Event> {
-        self.packet_num += 1;
-
+    fn analyze_information_element(
+        &mut self,
+        ie: &InformationElement,
+        _packet_num: usize,
+    ) -> Option<Event> {
        if let InformationElement::LTE(lte_ie) = ie
            && let LteInformationElement::BcchDlSch(sch_msg) = &**lte_ie
            && let BCCH_DL_SCH_MessageType::C1(c1) = &sch_msg.message
@@ -44,11 +32,8 @@ impl Analyzer for IncompleteSibAnalyzer {
            && sib1.scheduling_info_list.0.len() < 2
        {
            return Some(Event {
-                event_type: EventType::Medium,
-                message: format!(
-                    "SIB1 scheduling info list was malformed (packet {})",
-                    self.packet_num
-                ),
+                event_type: EventType::Informational,
+                message: "SIB1 scheduling info list was malformed".to_string(),
            });
        }
        None
@@ -7,21 +7,7 @@ use pycrate_rs::nas::generated::emm::emm_security_mode_command::NASSecAlgoCiphAl
 use super::analyzer::{Analyzer, Event, EventType};
 use super::information_element::{InformationElement, LteInformationElement};

-pub struct NasNullCipherAnalyzer {
-    packet_num: usize,
-}
-
-impl Default for NasNullCipherAnalyzer {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl NasNullCipherAnalyzer {
-    pub fn new() -> Self {
-        Self { packet_num: 0 }
-    }
-}
+pub struct NasNullCipherAnalyzer {}

 impl Analyzer for NasNullCipherAnalyzer {
    fn get_name(&self) -> Cow<'_, str> {
@@ -38,8 +24,11 @@ impl Analyzer for NasNullCipherAnalyzer {
        1
    }

-    fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<Event> {
-        self.packet_num += 1;
+    fn analyze_information_element(
+        &mut self,
+        ie: &InformationElement,
+        _packet_num: usize,
+    ) -> Option<Event> {
        let payload = match ie {
            InformationElement::LTE(inner) => match &**inner {
                LteInformationElement::NAS(payload) => payload,
@@ -53,10 +42,7 @@ impl Analyzer for NasNullCipherAnalyzer {
        {
            return Some(Event {
                event_type: EventType::High,
-                message: format!(
-                    "NAS Security mode command requested null cipher(packet {})",
-                    self.packet_num
-                ),
+                message: "NAS Security mode command requested null cipher".to_string(),
            });
        }
        None
@@ -131,7 +131,11 @@ impl Analyzer for NullCipherAnalyzer {
        1
    }

-    fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<Event> {
+    fn analyze_information_element(
+        &mut self,
+        ie: &InformationElement,
+        _packet_num: usize,
+    ) -> Option<Event> {
        let dcch_msg = match ie {
            InformationElement::LTE(lte_ie) => match &**lte_ie {
                LteInformationElement::DlDcch(dcch_msg) => dcch_msg,
@@ -49,6 +49,7 @@ impl Analyzer for LteSib6And7DowngradeAnalyzer {
    fn analyze_information_element(
        &mut self,
        ie: &InformationElement,
+        _packet_num: usize,
    ) -> Option<super::analyzer::Event> {
        let sibs = &self.unpack_system_information(ie)?.0;
        for sib in sibs {
@@ -6,21 +6,7 @@ use super::analyzer::{Analyzer, Event, EventType};
 use super::information_element::{InformationElement, LteInformationElement};
 use deku::bitvec::*;

-pub struct TestAnalyzer {
-    packet_num: usize,
-}
-
-impl Default for TestAnalyzer {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl TestAnalyzer {
-    pub fn new() -> Self {
-        Self { packet_num: 0 }
-    }
-}
+pub struct TestAnalyzer {}

 impl Analyzer for TestAnalyzer {
    fn get_name(&self) -> Cow<'_, str> {
@@ -37,9 +23,11 @@ impl Analyzer for TestAnalyzer {
        1
    }

-    fn analyze_information_element(&mut self, ie: &InformationElement) -> Option<Event> {
-        self.packet_num += 1;
-
+    fn analyze_information_element(
+        &mut self,
+        ie: &InformationElement,
+        _packet_num: usize,
+    ) -> Option<Event> {
        if let InformationElement::LTE(lte_ie) = ie
            && let LteInformationElement::BcchDlSch(sch_msg) = &**lte_ie
            && let BCCH_DL_SCH_MessageType::C1(c1) = &sch_msg.message
@@ -50,23 +38,32 @@ impl Analyzer for TestAnalyzer {
                .cell_identity
                .0
                .as_bitslice()
-                .load::<u32>();
+                .load_be::<u32>();
            let plmn = &sib1.cell_access_related_info.plmn_identity_list.0;
            let mcc_string: String;

+            // MCC are always 3 digits
            if let Some(mcc) = &plmn[0].plmn_identity.mcc {
                mcc_string = format!("{}{}{}", mcc.0[0].0, mcc.0[1].0, mcc.0[2].0);
            } else {
                mcc_string = "nomcc".to_string();
            }
            let mnc = &plmn[0].plmn_identity.mnc;
-            let mnc_string: String = format!("{}{}{}", mnc.0[0].0, mnc.0[1].0, mnc.0[2].0);
+            let mnc_string: String;
+            // MNC can be 2 or 3 digits
+            if mnc.0.len() == 3 {
+                mnc_string = format!("{}{}{}", mnc.0[0].0, mnc.0[1].0, mnc.0[2].0);
+            } else if mnc.0.len() == 2 {
+                mnc_string = format!("{}{}", mnc.0[0].0, mnc.0[1].0);
+            } else {
+                mnc_string = format!("{:?}", mnc.0);
+            }

            return Some(Event {
                event_type: EventType::Low,
                message: format!(
-                    "SIB1 received (packet {}) CID: {}, PLMN: {}-{}",
-                    self.packet_num, cid, mcc_string, mnc_string
+                    "SIB1 received CID: {}, PLMN: {}-{}",
+                    cid, mcc_string, mnc_string
                ),
            });
        }
@@ -1,6 +1,6 @@
 [package]
 name = "rootshell"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2024"

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -1,6 +1,6 @@
 [package]
 name = "telcom-parser"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2024"

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
Author	SHA1	Message	Date
Cooper Quintin	69260d21ac	bump version to 0.7.0	2025-09-24 11:17:39 -07:00
Cooper Quintin	f65e5708fc	downgarde incomplete sib heuristic to informational	2025-09-24 11:07:48 -07:00
Brad Warren	6eba455e42	suggest using different usb to troubleshoot	2025-09-24 10:52:13 -07:00
Markus Unterwaditzer	dd0b8050b8	Clarify documentation around TLS backends	2025-09-23 10:05:05 -07:00
Markus Unterwaditzer	6009123649	try to simplify workflows	2025-09-23 10:05:05 -07:00
Markus Unterwaditzer	549d3a6a8f	Avoid rustcrypto backend for release builds	2025-09-23 10:05:05 -07:00
Markus Unterwaditzer	3dc807fc63	Do not print instructions for admin UI when telnet is already running	2025-09-22 12:33:38 -07:00
Markus Unterwaditzer	95fe938eeb	Refactor and comment JS code	2025-09-22 12:33:38 -07:00
Markus Unterwaditzer	3ada0fa259	fix CI: Daemon should build if installer changed	2025-09-22 12:33:38 -07:00
Markus Unterwaditzer	48a4b43a39	Attempt to fix TP-Link race condition	2025-09-22 12:33:38 -07:00
Simon Fondrie-Teitler	f3c34ce0d3	Fix issue where low battery alert is fired on reboot when batter is 10%	2025-09-22 12:31:57 -07:00
Simon Fondrie-Teitler	1b5575e5a6	Update ConfigForm.svelte Signed-off-by: Simon Fondrie-Teitler <simonft@riseup.net>	2025-09-22 12:31:57 -07:00
Evan Anderson	1cf6f5d339	installer: Fix installation in skip-sdcard case (#604 )	2025-09-19 18:40:18 +02:00
Simon Fondrie-Teitler	b00f17d8fc	Use a cancellation token for restart logic as well (#602 )	2025-09-18 10:00:07 +02:00
Simon Fondrie-Teitler	766f3461d3	Simplify shutdown with cancellation tokens (#601 )	2025-09-18 00:33:44 +02:00
Simon Fondrie-Teitler	d30dd6fd9d	Don't show scroll bars with no overflow	2025-09-17 11:38:53 -07:00
bsickler	10e76e351e	Maintenance: Removes unused PNG (#598 )	2025-09-14 00:09:46 +02:00
Burton Sickler	301d130cdd	adds filter to incoming events	2025-09-12 11:34:28 +02:00
Hu8r1z	7a602b577d	Update AnalysisTable.svelte corrected ususally to usually	2025-09-12 11:24:19 +02:00
Tom Plant	f52c673b25	Fix several typos in docs Ran `typos doc --write-changes` from https://github.com/crate-ci/typos and reviewed	2025-09-10 10:44:53 +02:00
Matthew Callis	e6b9624a34	Fix typo in heuristics.md phoen ➜ phone Fix typo in `doc/heuristics.md` `phoen` ➜ `phone`	2025-09-09 20:08:11 +02:00
Cooper Quintin	15c0ba3805	cargo fmt	2025-09-05 13:22:42 -07:00
Cooper Quintin	de4a622c68	decode with correct byte order. Fixes #562	2025-09-05 13:22:42 -07:00
Cooper Quintin	a582715177	handle 2 digit MNC. Fixes #580	2025-09-05 13:22:42 -07:00
Markus Unterwaditzer	e68ba6ba52	Always run all builds with -p Running without -p can confuse cargo to enable the wrong set of featureflags. Fix #581	2025-09-03 00:19:17 +02:00
Brad Warren	e216043a14	make analyze_information_element private	2025-09-02 15:18:33 -07:00
Brad Warren	e2bc3a0a67	append packet num in harness & fix packet count	2025-09-02 15:18:33 -07:00
Brad Warren	87d6d1691a	track packet num in analysis harness	2025-09-02 15:18:33 -07:00
Sashanoraa	7475cd5cd9	Hide error count in error toast if there is only 1 error	2025-08-28 16:20:16 -07:00
Sashanoraa	cef94ba6b0	Add log view modal to web UI	2025-08-28 16:19:17 -07:00
Sashanoraa	d7c973ea95	Add api for getting rayhunter's log file	2025-08-28 16:19:17 -07:00
Simon Fondrie-Teitler	64d657efd6	Don't return an error if there's an issue parsing battery status	2025-08-28 16:09:09 -07:00
Simon Fondrie-Teitler	16447ed8bf	Use percentage battery in frontend and not levels	2025-08-28 16:09:09 -07:00
Simon Fondrie-Teitler	663d0abb57	Add battery level to web UI	2025-08-28 16:09:09 -07:00
Simon Fondrie-Teitler	f49d11f034	Skip updating web UI when browser tab isn't visible This will save bandwith and battery on the hotspot in cases where the UI tab is left open. See #564.	2025-08-27 22:52:34 +02:00
Cooper Quintin	56dcfdb47c	Update orbic.md	2025-08-26 10:17:54 -07:00
Markus Unterwaditzer	a46ede37b6	Fix links in README	2025-08-26 09:22:07 -07:00
Cooper Quintin	69dc528f34	bump version to 0.6.1	2025-08-25 22:28:10 +02:00
Cooper Quintin	29ce6729ee	fix readme links	2025-08-25 11:23:34 -07:00
Cooper Quintin	5919a19aba	revert removing link	2025-08-25 09:29:28 -07:00
Cooper Quintin	35ca590e46	improvements to documentation	2025-08-25 09:29:28 -07:00
Sashanoraa	56122f6559	Add error reporting to the daemon web UI This error reporting comes in two forms: - Errors updating the UI - Errors with user actions The former is displayed as one error until a refresh succeeds again. The latter creates an number of persistent errors until they are cleared by the user.	2025-08-25 03:15:25 -04:00
Cooper Quintin	bbab29ae0b	Update lib/src/analysis/imsi_requested.rs Co-authored-by: Markus Unterwaditzer <markus-tarpit+git@unterwaditzer.net>	2025-08-22 15:37:18 -07:00
Cooper Quintin	2a620fd1fb	cargo fmt	2025-08-22 15:37:18 -07:00
Cooper Quintin	515bb40a76	fix false positive on identity requested without attach described in #557	2025-08-22 15:37:18 -07:00
Cooper Quintin	a5ec1c9505	more verbosity	2025-08-22 23:55:40 +02:00
Markus Unterwaditzer	806bd62a0e	Document reanalyzing feature, and include rayhunter-check in release	2025-08-22 23:55:40 +02:00